CVE catalog
CVE-2020-23904
UBUNTU-CVE-2020-23904
- Severity
- Medium · CVSS 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.72% · Oct 27, 2026
A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. NOTE: the vendor states "I cannot reproduce it" and it "is a demo program.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | speex | pro | 1.2~rc1.2-1ubuntu1 | vulnerable |
| Ubuntu | speex | pro | 1.2~rc1.2-1ubuntu1+esm1 | vulnerable |
| Ubuntu | speex | 18.04 | 1.2~rc1.2-1ubuntu1 | vulnerable |
| Ubuntu | speex | 18.04 | 1.2~rc1.2-1ubuntu2 | vulnerable |
| Ubuntu | speex | 18.04 | 1.2~rc1.2-1ubuntu2.1 | vulnerable |
| Ubuntu | speex | 20.04 | 1.2~rc1.2-1ubuntu2 | vulnerable |
| Ubuntu | speex | 20.04 | 1.2~rc1.2-1.1ubuntu1 | vulnerable |
| Ubuntu | speex | 20.04 | 1.2~rc1.2-1.1ubuntu1.20.04.1 | vulnerable |
| Ubuntu | speex | 22.04 | 1.2~rc1.2-1.1ubuntu1 | vulnerable |
| Ubuntu | speex | 22.04 | 1.2~rc1.2-1.1ubuntu2 | vulnerable |
| Ubuntu | speex | 22.04 | 1.2~rc1.2-1.1ubuntu3 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: