libvorbis 1.1.2 contains several vulnerabilities allowing heap overwrite, read violations and a function pointer overwrite. These bugs cause a at least a denial of service, and potentially code execution.
Vulnerable Systems:
* libvorbis version 1.1.2 and prior
Immune Systems:
* libvorbis version 1.2.0 and newer
Invalid blocksize_0 and blocksize_1 values result in a heap overwrite in the _01inverse() function of res0.c.
An invalid mapping type causes an out of bounds dispatch table lookup, offset by an attacker-controlled value, during cleanup in
vorbis_info_clear() in info.c.
Additionally, invalid blocksize values cause a segmentation fault on read in block.c.
