CVE-2023-47466

Publication date 22 May 2025

Last updated 2 July 2025


Ubuntu priority

Cvss 3 Severity Score

2.9 · Low

Score breakdown

Description

TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.

Read the notes from the security team

Why is this CVE low priority?

Only a denial of service when writing to a corrupted WAV file

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
taglib 25.04 plucky
Not affected
24.10 oracular Ignored end of life, was needs-triage
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation

Notes


mdeslaur

Only a denial of service when writing to a corrupted WAV file, this has a low security impact

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
taglib

Severity score breakdown

Parameter Value
Base score 2.9 · Low
Attack vector Local
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact Low
Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L