Vulnerabilities
13 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-28434 | This affects all versions of package gitblame. This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — | |
| CVE-2017-15045 +1 in the same advisory: …15046 | LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to lam LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to lame_encode_buffer_sample_t in libmp3lame/lame.c, a different vulnerability than CVE-2017-9410. NVD description · AI analysis pending | 5.5 | <1% | PoC |
| — | |
| CVE-2017-15019 +1 in the same advisory: …15018 | LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrec LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call. NVD description · AI analysis pending | 7.8 group max | 1% | PoC |
| — | |
| CVE-2017-13712 | NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument. NVD description · AI analysis pending | 7.5 | 2% |
| — | ||
| CVE-2017-11720 | There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file. There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file. NVD description · AI analysis pending | 9.8 | 2% | PoC |
| — | |
| CVE-2017-9412 | The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and applicatio The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file. NVD description · AI analysis pending | 5.5 | 4% | PoC |
| — | |
| CVE-2017-9872 | The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denia The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file. NVD description · AI analysis pending | 7.8 group max | 10% |
| — | ||
| CVE-2017-8419 | LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file, as demonstrated by mishandling of num_channels. NVD description · AI analysis pending | 7.8 | 2% | PoC |
| — |