CVE-2014-0044
Mumble 1.2.4 - Denial of Service via Crafted Opus Packet Length Prefix
Title source: llmDescription
The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access").
References (4)
Core 4
Core References
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2014/dsa-2854
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/102904
Vendor Advisory x_refsource_confirm
http://mumble.info/security/Mumble-SA-2014-001.txt
Scores
EPSS
0.0245
EPSS Percentile
82.4%
Details
CWE
CWE-119
Status
published
Products (2)
light_speed_gaming/mumble
1.2.3 rc1 (3 CPE variants)
light_speed_gaming/mumble
1.2.4
Published
Feb 08, 2014
Tracked Since
Feb 18, 2026