Threat Intelligence Database

A divide-by-zero vulnerability exists in libtta through version 2.3 in the function tta_decoder_init_get_info(). This flaw allows attackers to crash applications by providing a specially crafted .tta audio file with a zero sample rate, causing a SIGFPE signal. The vulnerability affects the bundled tta console tool and potentially other applications using libtta. The issue has a medium severity rating with a CVSS score of 6.8.

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache[-1] with stream-derived values, corrupting stack memory in decoding applications.

libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek table allocation and crashing applications.