CVE-2014-0045
The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 4.03% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-189
- Affected
- light speed gaming/mumble · light speed gaming/mumblekit
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html
- http://mumble.info/security/Mumble-SA-2014-002.txt
- http://mumble.info/security/Mumble-SA-2014-004.txtVendor Advisory
- http://osvdb.org/102905
- http://osvdb.org/102958
- http://www.debian.org/security/2014/dsa-2854
- http://www.securityfocus.com/bid/65374
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html
- http://mumble.info/security/Mumble-SA-2014-002.txt
- http://mumble.info/security/Mumble-SA-2014-004.txtVendor Advisory
- http://osvdb.org/102905
- http://osvdb.org/102958
- http://www.debian.org/security/2014/dsa-2854
- http://www.securityfocus.com/bid/65374
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.