CVE catalog

CVE-2004-2779

libid3tag: CVE-2004-2779

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.46% · Oct 25, 2026

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibid3tagsid0.16.3-4fixed
Debianlibid3tagforky0.16.3-4fixed
Debianlibid3tagtrixie0.16.3-1fixed
Debianlibid3tagbookworm0.15.1b-14fixed
Suselibid3taglinux enterprise desktop 12 sp20.15.1b-184.3.1fixed
Suselibid3taglinux enterprise desktop 12 sp30.15.1b-184.3.1fixed
Suselibid3taglinux enterprise software development kit 12 sp20.15.1b-184.3.1fixed
Suselibid3taglinux enterprise software development kit 12 sp30.15.1b-184.3.1fixed
Suselibid3taglinux enterprise workstation extension 12 sp20.15.1b-184.3.1fixed
Suselibid3taglinux enterprise workstation extension 12 sp30.15.1b-184.3.1fixed
Suselibid3taglinux enterprise software development kit 11 sp40.15.1b-132.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibid3tagsourcesid0.15.1b-5not yet assignedNot reported[304913]
Debianlibid3tagsourceforky0.15.1b-5not yet assignedNot reported[304913]
Debianlibid3tagsourcetrixie0.15.1b-5not yet assignedNot reported[304913]
Debianlibid3tagsourcebookworm0.15.1b-5not yet assignedNot reported[304913]
Suselibid3tagrpmlinux enterprise desktop 12 sp20.15.1b-184.3.1Not reportedSUSE-SU-2018:0722-1Not reported
Suselibid3tagrpmlinux enterprise desktop 12 sp30.15.1b-184.3.1Not reportedSUSE-SU-2018:0722-1Not reported
Suselibid3tagrpmlinux enterprise software development kit 12 sp20.15.1b-184.3.1Not reportedSUSE-SU-2018:0722-1Not reported
Suselibid3tagrpmlinux enterprise software development kit 12 sp30.15.1b-184.3.1Not reportedSUSE-SU-2018:0722-1Not reported
Suselibid3tagrpmlinux enterprise workstation extension 12 sp20.15.1b-184.3.1Not reportedSUSE-SU-2018:0722-1Not reported
Suselibid3tagrpmlinux enterprise workstation extension 12 sp30.15.1b-184.3.1Not reportedSUSE-SU-2018:0722-1Not reported
Suselibid3tagrpmlinux enterprise software development kit 11 sp40.15.1b-132.3.1Not reportedSUSE-SU-2018:0715-1Not reported

[Debian bug #304913]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libid3tag0]Fixed

    Source package: [libid3tag]

    Details (2)

    • 0.15.1b-14 · amd64 · bookworm

      Fixed · Fixed: 0.15.1b-5

      dsa · libid3tag · debian · bookworm; dsa · libid3tag · debian · 12

    • 0.15.1b-14 · arm64 · bookworm

      Fixed · Fixed: 0.15.1b-5

      dsa · libid3tag · debian · bookworm; dsa · libid3tag · debian · 12

  • [libid3tag0-dev]Fixed

    Source package: [libid3tag]

    Details (2)

    • 0.15.1b-14 · amd64 · bookworm

      Fixed · Fixed: 0.15.1b-5

      dsa · libid3tag · debian · bookworm; dsa · libid3tag · debian · 12

    • 0.15.1b-14 · arm64 · bookworm

      Fixed · Fixed: 0.15.1b-5

      dsa · libid3tag · debian · bookworm; dsa · libid3tag · debian · 12

[Debian 13 (Trixie)]

  • [libid3tag0]Fixed

    Source package: [libid3tag]

    Details (2)

    • 0.16.3-1 · amd64 · trixie

      Fixed · Fixed: 0.15.1b-5

      dsa · libid3tag · debian · 13

    • 0.16.3-1 · arm64 · trixie

      Fixed · Fixed: 0.15.1b-5

      dsa · libid3tag · debian · 13

  • [libid3tag0-dev]Fixed

    Source package: [libid3tag]

    Details (2)

    • 0.16.3-1 · amd64 · trixie

      Fixed · Fixed: 0.15.1b-5

      dsa · libid3tag · debian · 13

    • 0.16.3-1 · arm64 · trixie

      Fixed · Fixed: 0.15.1b-5

      dsa · libid3tag · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]