CVE catalog

CVE-2020-23903

speex: CVE-2020-23903

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.01% · Oct 25, 2026

A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspeexsid1.2.1-3fixed
Debianspeexforky1.2.1-3fixed
Debianspeextrixie1.2.1-3fixed
Debianspeexbookworm1.2.1-2fixed
Ubuntuspeexpro1.2~rc1.2-1ubuntu1vulnerable
Ubuntuspeexpro1.2~rc1.2-1ubuntu1+esm1fixed
Ubuntuspeex18.041.2~rc1.2-1ubuntu1vulnerable
Ubuntuspeex18.041.2~rc1.2-1ubuntu2vulnerable
Ubuntuspeex18.041.2~rc1.2-1ubuntu2.1fixed
Ubuntuspeex20.041.2~rc1.2-1ubuntu2vulnerable
Ubuntuspeex20.041.2~rc1.2-1.1ubuntu1vulnerable
Ubuntuspeex20.041.2~rc1.2-1.1ubuntu1.20.04.1fixed
Ubuntuspeexpro1.2~rc1.2-1ubuntu1vulnerable
Ubuntuspeexpro1.2~rc1.2-1ubuntu1+esm1fixed
Ubuntuspeex18.041.2~rc1.2-1ubuntu1vulnerable
Ubuntuspeex18.041.2~rc1.2-1ubuntu2vulnerable
Ubuntuspeex18.041.2~rc1.2-1ubuntu2.1fixed
Ubuntuspeex20.041.2~rc1.2-1ubuntu2vulnerable
Ubuntuspeex20.041.2~rc1.2-1.1ubuntu1vulnerable
Ubuntuspeex20.041.2~rc1.2-1.1ubuntu1.20.04.1fixed
Ubuntuspeex22.041.2~rc1.2-1.1ubuntu1vulnerable
Ubuntuspeex22.041.2~rc1.2-1.1ubuntu2vulnerable
Ubuntuspeex22.041.2~rc1.2-1.1ubuntu3fixed
Opensusespeextumbleweed1.2-2.1fixed
Susespeexlinux enterprise module for basesystem 15 sp21.2-3.3.1fixed
Susespeexlinux enterprise module for basesystem 15 sp31.2-3.3.1fixed
Susespeexlinux enterprise module for package hub 15 sp21.2-3.3.1fixed
Susespeexlinux enterprise module for package hub 15 sp31.2-3.3.1fixed
Opensusespeexleap 15.21.2-lp152.4.3.1fixed
Susespeexlinux enterprise software development kit 12 sp51.1.999_1.2rc1-24.3.1fixed
Susespeexlinux enterprise server 12 sp51.1.999_1.2rc1-24.3.1fixed
Susespeexlinux enterprise server for sap applications 12 sp51.1.999_1.2rc1-24.3.1fixed
Opensusespeexleap 15.31.2-3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspeexsourcesid1.2~rc1.2-2not yet assignedNot reportedNot reported
Debianspeexsourceforky1.2~rc1.2-2not yet assignedNot reportedNot reported
Debianspeexsourcetrixie1.2~rc1.2-2not yet assignedNot reportedNot reported
Debianspeexsourcebookworm1.2~rc1.2-2not yet assignedNot reportedNot reported
Ubuntuspeexdebpro1.2~rc1.2-1ubuntu1+esm1Not reportedUSN-5280-1Not reported
Ubuntuspeexdeb18.041.2~rc1.2-1ubuntu2.1Not reportedUSN-5280-1Not reported
Ubuntuspeexdeb20.041.2~rc1.2-1.1ubuntu1.20.04.1Not reportedUSN-5280-1Not reported
Ubuntuspeexdebpro1.2~rc1.2-1ubuntu1+esm1Not reportedUBUNTU-CVE-2020-23903Not reported
Ubuntuspeexdeb18.041.2~rc1.2-1ubuntu2.1Not reportedUBUNTU-CVE-2020-23903Not reported
Ubuntuspeexdeb20.041.2~rc1.2-1.1ubuntu1.20.04.1Not reportedUBUNTU-CVE-2020-23903Not reported
Ubuntuspeexdeb22.041.2~rc1.2-1.1ubuntu3Not reportedUBUNTU-CVE-2020-23903Not reported
Opensusespeexrpmtumbleweed1.2-2.1Not reportedOPENSUSE-SU-2024:11632-1Not reported
Susespeexrpmlinux enterprise module for basesystem 15 sp21.2-3.3.1Not reportedSUSE-SU-2021:3860-1Not reported
Susespeexrpmlinux enterprise module for basesystem 15 sp31.2-3.3.1Not reportedSUSE-SU-2021:3860-1Not reported
Susespeexrpmlinux enterprise module for package hub 15 sp21.2-3.3.1Not reportedSUSE-SU-2021:3860-1Not reported
Susespeexrpmlinux enterprise module for package hub 15 sp31.2-3.3.1Not reportedSUSE-SU-2021:3860-1Not reported
Opensusespeexrpmleap 15.21.2-lp152.4.3.1Not reportedOPENSUSE-SU-2021:1538-1Not reported
Susespeexrpmlinux enterprise software development kit 12 sp51.1.999_1.2rc1-24.3.1Not reportedSUSE-SU-2021:3858-1Not reported
Susespeexrpmlinux enterprise server 12 sp51.1.999_1.2rc1-24.3.1Not reportedSUSE-SU-2021:3858-1Not reported
Susespeexrpmlinux enterprise server for sap applications 12 sp51.1.999_1.2rc1-24.3.1Not reportedSUSE-SU-2021:3858-1Not reported
Opensusespeexrpmleap 15.31.2-3.3.1Not reportedOPENSUSE-SU-2021:3860-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libspeex1]Unknown

    Source package: [speex]

    Details (1)

    • 1.2.1-2.8 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2-2.1

      Version impact unknown

      dsa · speex · opensuse · tumbleweed

  • [libspeex1-32bit]Unknown

    Source package: [speex]

    Details (1)

    • 1.2.1-2.8 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2-2.1

      Version impact unknown

      dsa · speex · opensuse · tumbleweed

  • [speex-devel]Unknown

    Source package: [speex]

    Details (1)

    • 1.2.1-2.8 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2-2.1

      Version impact unknown

      dsa · speex · opensuse · tumbleweed

  • [speex]Fixed

    Source package: [speex]

    Details (1)

    • 1.2.1-2.8 · x86_64 · tumbleweed

      Fixed · Fixed: 1.2-2.1

      dsa · speex · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libspeex1]Fixed

    Source package: [speex]

    Details (2)

    • 1.2.1-2 · amd64 · bookworm

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · bookworm; dsa · speex · debian · 12

    • 1.2.1-2 · arm64 · bookworm

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · bookworm; dsa · speex · debian · 12

  • [libspeex-dev]Fixed

    Source package: [speex]

    Details (2)

    • 1.2.1-2 · amd64 · bookworm

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · bookworm; dsa · speex · debian · 12

    • 1.2.1-2 · arm64 · bookworm

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · bookworm; dsa · speex · debian · 12

  • [speex]Fixed
    Details (2)

    • 1.2.1-2 · amd64 · bookworm

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · bookworm; dsa · speex · debian · 12

    • 1.2.1-2 · arm64 · bookworm

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · bookworm; dsa · speex · debian · 12

  • [speex-doc]Fixed

    Source package: [speex]

    Details (2)

    • 1.2.1-2 · all · bookworm

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · bookworm; dsa · speex · debian · 12

    • 1.2.1-2 · all · bookworm

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · bookworm; dsa · speex · debian · 12

[Debian 13 (Trixie)]

  • [libspeex1]Fixed

    Source package: [speex]

    Details (2)

    • 1.2.1-3 · amd64 · trixie

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · 13

    • 1.2.1-3 · arm64 · trixie

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · 13

  • [libspeex-dev]Fixed

    Source package: [speex]

    Details (2)

    • 1.2.1-3 · amd64 · trixie

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · 13

    • 1.2.1-3 · arm64 · trixie

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · 13

  • [speex]Fixed
    Details (2)

    • 1.2.1-3 · amd64 · trixie

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · 13

    • 1.2.1-3 · arm64 · trixie

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · 13

  • [speex-doc]Fixed

    Source package: [speex]

    Details (2)

    • 1.2.1-3 · all · trixie

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · 13

    • 1.2.1-3 · all · trixie

      Fixed · Fixed: 1.2~rc1.2-2

      dsa · speex · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]