Deskripsi CVE

The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write.

Informasi CVE

Kelemahan Terkait

CWE-ID	Nama Kelemahan	Sumber
CWE-189	Category : Numeric Errors Weaknesses in this category are related to improper calculation or conversion of numbers.

Metrik

Metrik	Skor	Tingkat keparahan	CVSS Vektor	Sumber
V2	7.5		AV:N/AC:L/Au:N/C:P/I:P/A:P	nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

EPSS First.org

Produk yang Disebutkan

Konfigurasi 0

Light_speed_gaming>>Mumble >> Version 1.1

Light_speed_gaming>>Mumble >> Version 1.1.1

Light_speed_gaming>>Mumble >> Version 1.2

Light_speed_gaming>>Mumble >> Version 1.2.1

Light_speed_gaming>>Mumble >> Version 1.2.2

Light_speed_gaming>>Mumble >> Version 1.2.3

Light_speed_gaming>>Mumble >> Version 1.2.4

Light_speed_gaming>>Mumblekit >> Version -

Referensi

http://www.debian.org/security/2014/dsa-2854
Tags : vendor-advisory, x_refsource_DEBIAN

http://osvdb.org/102958
Tags : vdb-entry, x_refsource_OSVDB

http://mumble.info/security/Mumble-SA-2014-004.txt
Tags : x_refsource_CONFIRM

http://osvdb.org/102905
Tags : vdb-entry, x_refsource_OSVDB

http://mumble.info/security/Mumble-SA-2014-002.txt
Tags : x_refsource_CONFIRM

http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html
Tags : vendor-advisory, x_refsource_SUSE

http://www.securityfocus.com/bid/65374
Tags : vdb-entry, x_refsource_BID

Tanggal	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	5.14%	–	–
2022-03-06	–	–	5.14%	–	–
2022-04-03	–	–	5.14%	–	–
2023-02-26	–	–	5.14%	–	–
2023-03-12	–	–	–	8.52%	–
2023-06-04	–	–	–	8.52%	–
2023-08-06	–	–	–	8.48%	–
2024-06-02	–	–	–	8.48%	–
2024-08-11	–	–	–	8.48%	–
2024-12-22	–	–	–	9.11%	–
2025-01-19	–	–	–	9.11%	–
2025-03-18	–	–	–	–	2.66%
2025-03-30	–	–	–	–	2.66%
2025-04-06	–	–	–	–	2.66%
2025-11-18	–	–	–	–	2.66%
2025-11-21	–	–	–	–	2.66%
2026-03-01	–	–	–	–	2.66%

Tanggal	Persentil
2022-02-06	75%
2022-03-06	76%
2022-04-03	89%
2023-02-26	9%
2023-03-12	93%
2023-06-04	94%
2023-08-06	94%
2024-06-02	94%
2024-08-11	95%
2024-12-22	95%
2025-01-19	95%
2025-03-18	85%
2025-03-30	84%
2025-04-06	85%
2025-11-18	84%
2025-11-21	85%
2026-03-01	86%

CVE-2014-0045 : Detail

CVE-2014-0045