{"id":"CVE-2017-12678","details":"In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.","modified":"2026-07-08T12:05:56.293399Z","published":"2017-08-08T01:34:00.080Z","related":["openSUSE-SU-2024:11421-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00020.html"},{"type":"FIX","url":"https://github.com/taglib/taglib/commit/cb9f07d9dcd791b63e622da43f7b232adaec0a9a"},{"type":"FIX","url":"https://github.com/taglib/taglib/issues/829"},{"type":"FIX","url":"https://github.com/taglib/taglib/pull/831"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/taglib/taglib","events":[{"introduced":"e36a9cabb9882e61276161c23834d966d62073b7"},{"last_affected":"e36a9cabb9882e61276161c23834d966d62073b7"},{"fixed":"cb9f07d9dcd791b63e622da43f7b232adaec0a9a"}],"database_specific":{"cpe":"cpe:2.3:a:taglib:taglib:1.11.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.11.1"},{"last_affected":"1.11.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.11.1","v1.11.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12678.json","vanir_signatures_modified":"2026-07-08T12:05:56Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/taglib/taglib/commit/cb9f07d9dcd791b63e622da43f7b232adaec0a9a","target":{"file":"taglib/mpeg/id3v2/id3v2framefactory.cpp","function":"FrameFactory::rebuildAggregateFrames"},"deprecated":false,"digest":{"length":1162,"function_hash":"63189154665858681151973652675033772745"},"id":"CVE-2017-12678-51e627e6"},{"id":"CVE-2017-12678-99eaacdd","signature_type":"Line","signature_version":"v1","source":"https://github.com/taglib/taglib/commit/cb9f07d9dcd791b63e622da43f7b232adaec0a9a","target":{"file":"taglib/mpeg/id3v2/id3v2framefactory.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["220139894708303143899526924524560798224","331122330798241866706006235958792627874","115681426174653110933180385216535435262","143728083367336673008615923459110808737","100579267743060690021987545153789673597","321646883927881145213580466139976781879"]}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}