CVE-2017-15018

Published: Oct 5, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.

Affected (9)

Products: Lame Project: Lame

Lame Project

1 product

Lame

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Lame Project Lame	Version 3.98.2
Lame Project Lame	Version 3.98.4
Lame Project Lame	Version 3.98
Lame Project Lame	Version 3.99.1
Lame Project Lame	Version 3.99.2
Lame Project Lame	Version 3.99.3
Lame Project Lame	Version 3.99.4
Lame Project Lame	Version 3.99.5
Lame Project Lame	Version 3.99

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (2)

https://sourceforge.net/p/lame/bugs/480/

Source: cve@mitre.org

ExploitThird Party Advisory

https://sourceforge.net/p/lame/bugs/480/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.