NULL pointer dereference in TagLib - CVE-2023-47466

Vulnerability identifier: #VU120624

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-47466

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can pass a specially crafted WAV file to the application and perform a denial of service (DoS) attack.

TagLib
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
Desktop Applications Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
taglib-debuginfo
taglib-debugsource
taglib-devel
taglib-help
taglib
libtag1
libtag1-64bit-debuginfo
libtag1-64bit
libtag_c0-64bit-debuginfo
libtag_c0-64bit
libtag-doc
libtag_c0-32bit-debuginfo
libtag1-32bit-debuginfo
libtag_c0-32bit
libtag1-32bit
libtag-devel
libtag_c0-debuginfo
libtag1-debuginfo
libtag_c0
taglib-doc

Install updates from vendor's website.

TagLib - update to 2.0
taglib-debuginfo - update to 1.11.1-13
taglib-debugsource - update to 1.11.1-13
taglib-devel - update to 1.11.1-13
taglib-help - update to 1.11.1-13
taglib - update to 1.11.1-13
libtag1 - update to 1.13.1-150600.3.3.1
libtag1-64bit-debuginfo - update to 1.13.1-150600.3.3.1
libtag1-64bit - update to 1.13.1-150600.3.3.1
libtag_c0-64bit-debuginfo - update to 1.13.1-150600.3.3.1
libtag_c0-64bit - update to 1.13.1-150600.3.3.1
libtag-doc - update to 1.13.1-150600.3.3.1
libtag_c0-32bit-debuginfo - update to 1.13.1-150600.3.3.1
libtag1-32bit-debuginfo - update to 1.13.1-150600.3.3.1
libtag_c0-32bit - update to 1.13.1-150600.3.3.1
libtag1-32bit - update to 1.13.1-150600.3.3.1
taglib-debuginfo - update to 1.13.1-150600.3.3.1
libtag-devel - update to 1.13.1-150600.3.3.1
taglib - update to 1.13.1-150600.3.3.1
libtag_c0-debuginfo - update to 1.13.1-150600.3.3.1
libtag1-debuginfo - update to 1.13.1-150600.3.3.1
libtag_c0 - update to 1.13.1-150600.3.3.1
taglib-debugsource - update to 1.13.1-150600.3.3.1
taglib - update to 1.13-2
taglib-devel - update to 1.13-2
taglib-doc - update to 1.13-2

• https://github.com/taglib/taglib/commit/dfa33bec0806cbb45785accb8cc6c2048a7d40cf
• https://github.com/taglib/taglib/compare/v1.13.1...v2.0
• https://github.com/taglib/taglib/issues/1163
• https://github.com/taglib/taglib/pull/1164

• NULL pointer dereference in TagLib
• openEuler update for taglib
• SUSE update for taglib
• Anolis OS update for taglib