CVE-2015-9101

Name of the Vulnerable Software and Affected Versions LAME versions 3.98 through 3.99.5

Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via a crafted audio file. This is due to a problem in the fill buffer resample function in util.c in libmp3lame.a.

Recommendations For versions 3.98 through 3.99.5, consider disabling the fill buffer resample function as a temporary workaround until a patch is available. Restrict the use of crafted audio files to minimize the risk of exploitation.