Lame

lame

Vendor: Lame Project • 15 CVEs

CVEs (15)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-15046 1Lame Project 1Lame May 13, 2026 Oct 6, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412.
CVE-2017-15045 1Lame Project 1Lame May 13, 2026 Oct 6, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to lame_encode_buffer_sample_t in libmp3lame/lame.c, a different v...Show more LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to lame_encode_buffer_sample_t in libmp3lame/lame.c, a different vulnerability than CVE-2017-9410.Show less
CVE-2017-15019 1Lame Project 1Lame May 13, 2026 Oct 5, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call.
CVE-2017-15018 1Lame Project 1Lame May 13, 2026 Oct 5, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
CVE-2017-13712 1Lame Project 1Lame May 13, 2026 Aug 28, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument.
CVE-2017-11720 1Lame Project 1Lame May 13, 2026 Jul 28, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.
CVE-2017-9412 1Lame Project 1Lame May 13, 2026 Jul 27, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
CVE-2017-9872 1Lame Project 1Lame May 13, 2026 Jun 25, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application cr...Show more The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.Show less
CVE-2017-9871 1Lame Project 1Lame May 13, 2026 Jun 25, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or p...Show more The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.Show less
CVE-2017-9870 1Lame Project 1Lame May 13, 2026 Jun 25, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted a...Show more The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type == 2" case, a similar issue to CVE-2017-11126.Show less
CVE-2017-9869 1Lame Project 1Lame May 13, 2026 Jun 25, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The II_step_one function in layer2.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted au...Show more The II_step_one function in layer2.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.Show less
CVE-2015-9101 1Lame Project 1Lame May 13, 2026 Jun 25, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4 and 3.99.5 allows remote attackers to cause a denial of service (heap-based buffer over-read...Show more The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4 and 3.99.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.Show less
CVE-2015-9100 1Lame Project 1Lame May 13, 2026 Jun 25, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
CVE-2015-9099 1Lame Project 1Lame May 13, 2026 Jun 25, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file with a negative sample rate.
CVE-2017-8419 1Lame Project 1Lame May 13, 2026 May 2, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or pos...Show more LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file, as demonstrated by mishandling of num_channels.Show less