CVE-2015-9101

The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4 and 3.99.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.

• CWE-119

• http://www.securityfocus.com/bid/99269Third Party Advisory, VDB Entry
• https://blogs.gentoo.org/ago/2017/06/17/lame-heap-based-buffer-overflow-in-fill_buffer_resample-util-c/Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777161Issue Tracking, Third Party Advisory
• https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2015-9101Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/99269Third Party Advisory, VDB Entry
• https://blogs.gentoo.org/ago/2017/06/17/lame-heap-based-buffer-overflow-in-fill_buffer_resample-util-c/Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777161Issue Tracking, Third Party Advisory
• https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2015-9101Exploit, Third Party Advisory

Published

Jun 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-9095Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-9096Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command…
• CVE-2015-9097The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail L…
• CVE-2015-9098In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a rem…9.8
• CVE-2015-9099The lame_init_params function in lame.c in libmp3lame.a in L…
• CVE-2015-9100The fill_buffer_resample function in util.c in libmp3lame.a …
• CVE-2015-9102Multiple cross-site scripting (XSS) vulnerabilities in Synol…
• CVE-2015-9103Multiple cross-site scripting (XSS) vulnerabilities in Synol…
• CVE-2015-9104Cross-site scripting (XSS) vulnerabilities in Synology Audio…
• CVE-2015-9105Multiple cross-site scripting (XSS) vulnerabilities in Synol…
• CVE-2015-9107Zoho ManageEngine OpManager 11 through 12.2 uses a custom en…
• CVE-2015-9108In Android before 2018-04-05 or earlier security patch level…