CVE-2018-10393

moderate-risk

Published 2018-04-26

bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.

Do I need to act?

0.38% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Libvorbis

Debian Linux

Enterprise Linux

Enterprise Linux Eus

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Debian Redhat Xiph.Org

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3703

Issue Tracking https://gitlab.xiph.org/xiph/vorbis/issues/2334

Mailing List https://lists.debian.org/debian-lts-announce/2019/11/msg00031.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/11/msg00023.html

Third Party Advisory https://security.gentoo.org/glsa/202003-36

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3703

Issue Tracking https://gitlab.xiph.org/xiph/vorbis/issues/2334

Mailing List https://lists.debian.org/debian-lts-announce/2019/11/msg00031.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/11/msg00023.html

Third Party Advisory https://security.gentoo.org/glsa/202003-36

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 16/34 · Moderate