CVE-2008-1419: xiph.org libvorbis Improper Input Validation

EPSS trend

Probability

4.25%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.25% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown

References

26 links

exchange.xforce.ibmcloud.com/vulnerabilities/42400VDB EntryX Refsource XF
secunia.com/advisories/30234Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.redhat.com/support/errata/RHSA-2008-0270.htmlVendor AdvisoryX Refsource REDHATNot Applicable
lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.debian.org/security/2008/dsa-1591Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2008-May/msg00256.htmlVendor AdvisoryX Refsource FEDORA
exchange.xforce.ibmcloud.com/vulnerabilities/42397VDB EntryX Refsource XF
www.redhat.com/archives/fedora-package-announce/2008-May/msg00247.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/support/errata/RHSA-2008-0271.htmlVendor AdvisoryX Refsource REDHATNot Applicable
www.securitytracker.com/id?1020029VDB EntryX Refsource SECTRACKThird Party Advisory

Show all 26 references

www.ubuntu.com/usn/USN-682-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/30237Third Party AdvisoryX Refsource SECUNIAPermissions Required
security.gentoo.org/glsa/glsa-200806-09.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10104VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/30479Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.securityfocus.com/bid/29206VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/30259Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.vupen.com/english/advisories/2008/1510/referencesVDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/30247Third Party AdvisoryX Refsource SECUNIAPermissions Required
secunia.com/advisories/30820Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.redhat.com/archives/fedora-package-announce/2008-May/msg00243.htmlVendor AdvisoryX Refsource FEDORA
www.mandriva.com/security/advisories?name=MDVSA-2008:102Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/32946Third Party AdvisoryX Refsource SECUNIAPermissions Required
secunia.com/advisories/30581Third Party AdvisoryX Refsource SECUNIAPermissions Required
bugzilla.redhat.com/show_bug.cgi?id=440700X Refsource CONFIRMExploitIssue Tracking
security-tracker.debian.org/tracker/CVE-2008-1419Advisory

Related vulnerabilities

CVE-2018-10393alpinelibvorbis+82.38%8y ago26-04-2018 05:00bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.CVE-2018-10392alpinelibvorbis+163.32%8y ago26-04-2018 05:00mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.CVE-2007-4065debianlibvorbis+21.68%19y ago21-09-2007 18:00lib/vorbisfile.c in libvorbisfile in Xiph.Org libvorbis before 1.2.0 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted OGG file, aka trac Changeset 13217.CVE-2007-4066debianlibvorbis+21.84%19y ago21-09-2007 18:00Multiple buffer overflows in Xiph.Org libvorbis before 1.2.0 allow context-dependent attackers to cause a denial of service or have other unspecified impact via a crafted OGG file, aka trac Changesets 13162, 13168, 13169, 13170, 13172, 13211, and 13215, as demonstrated by an overflow in oggenc.exe related to the _psy_noiseguards_8 array.CVE-2020-20412stepmaniastepmania+11.04%5y ago26-12-2020 00:00lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE: this may overlap CVE-2018-5146.CVE-2008-2009canonicalubuntu_linux+33.51%18y ago16-05-2008 06:54Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.

All vulnerabilities inlibvorbis

CVE-2008-1419: xiph.org libvorbis Improper Input Validation

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References