CVE-2017-15185

5.0 mediumEPSS 1.7%

plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, which allows remote attackers to cause a denial of service (application crash) via a crafted file.

Severity

CVSS 3.0

5.0 medium

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2017-10-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

libmp3splt_project:libmp3splt

References

http://seclists.org/fulldisclosure/2017/Jul/82
https://anonscm.debian.org/cgit/users/ron/mp3splt.git/commit/?id=18f018cd774cb931116ce06a520dc0c5f9443932
https://lists.debian.org/debian-lts/2017/09/msg00115.html
https://www.exploit-db.com/exploits/42399/
http://seclists.org/fulldisclosure/2017/Jul/82

Check your stack JSON