CVE-2008-2109 - Vulnerability Details - OpenCVE

field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an infinite loop.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.07431.

Key SSVC decision points have not yet been added.

Vendors	Products
Media-libs	Libid3tag

Configuration 1 [-]

cpe:2.3:a:media-libs:libid3tag:0.15.0b:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://bugs.gentoo.org/show_bug.cgi?id=210564
http://secunia.com/advisories/30173
http://secunia.com/advisories/30182
http://security.gentoo.org/glsa/glsa-200805-15.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:103
http://www.mars.org/mailman/public/mad-dev/2008-January/001366.html
http://www.securityfocus.com/bid/29210
https://exchange.xforce.ibmcloud.com/vulnerabilities/42271
https://www.cve.org/CVERecord?id=CVE-2008-2109
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00159.html

History

Wed, 28 May 2025 14:45:00 +0000

Type	Values Removed	Values Added
References		https://www.cve.org/CVERecord?id=CVE-2008-2109

Thu, 22 May 2025 04:30:00 +0000

Type	Values Removed	Values Added
References	https://nvd.nist.gov/vuln/detail/CVE-2008-2109 https://www.cve.org/CVERecord?id=CVE-2008-2109

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2008-05-07T21:00:00

Updated: 2024-08-07T08:49:58.160Z

Reserved: 2008-05-07T00:00:00

Link: CVE-2008-2109

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2008-05-07T21:20:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-2109

Redhat

Severity : Low

Publid Date: 2008-01-12T00:00:00Z

Links: CVE-2008-2109 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-01-12T00:00:00", "descriptions": [{"lang": "en", "value": "field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\\0', which triggers an infinite loop."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-07T12:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "MDVSA-2008:103", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:103"}, {"name": "GLSA-200805-15", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200805-15.xml"}, {"name": "FEDORA-2008-3757", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00159.html"}, {"name": "30173", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/30173"}, {"name": "30182", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/30182"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.gentoo.org/show_bug.cgi?id=210564"}, {"name": "29210", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/29210"}, {"name": "[mad-dev] 20080112 Initite loop bug in libid3tag-0.15.0b", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.mars.org/mailman/public/mad-dev/2008-January/001366.html"}, {"name": "libid3tag-field-dos(42271)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42271"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T08:49:58.160Z"}, "title": "CVE Program Container", "references": [{"name": "MDVSA-2008:103", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:103"}, {"name": "GLSA-200805-15", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200805-15.xml"}, {"name": "FEDORA-2008-3757", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00159.html"}, {"name": "30173", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/30173"}, {"name": "30182", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/30182"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.gentoo.org/show_bug.cgi?id=210564"}, {"name": "29210", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/29210"}, {"name": "[mad-dev] 20080112 Initite loop bug in libid3tag-0.15.0b", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.mars.org/mailman/public/mad-dev/2008-January/001366.html"}, {"name": "libid3tag-field-dos(42271)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42271"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2008-2109", "datePublished": "2008-05-07T21:00:00", "dateReserved": "2008-05-07T00:00:00", "dateUpdated": "2024-08-07T08:49:58.160Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:media-libs:libid3tag:0.15.0b:*:*:*:*:*:*:*", "matchCriteriaId": "FCAF58F1-1C61-49E6-83AF-7F85A595AD91", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\\0', which triggers an infinite loop."}, {"lang": "es", "value": "La librer\u00eda field.c de libid3tag 0.15.0b, permite a atacantes seg\u00fan contexto provocar una denegaci\u00f3n de servicio (consumo de CPU) a trav\u00e9s de un campo ID3_FIELD_TYPE_STRINGLIST que termina en '\\0', lo que genera un bucle infinito."}], "id": "CVE-2008-2109", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-05-07T21:20:00.000", "references": [{"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://bugs.gentoo.org/show_bug.cgi?id=210564"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/30173"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/30182"}, {"source": "secalert@redhat.com", "url": "http://security.gentoo.org/glsa/glsa-200805-15.xml"}, {"source": "secalert@redhat.com", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:103"}, {"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "http://www.mars.org/mailman/public/mad-dev/2008-January/001366.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/29210"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42271"}, {"source": "secalert@redhat.com", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00159.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://bugs.gentoo.org/show_bug.cgi?id=210564"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/30173"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/30182"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200805-15.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:103"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.mars.org/mailman/public/mad-dev/2008-January/001366.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/29210"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42271"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00159.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}