CVE-2015-9099

What it actually does

The vulnerability triggers an invalid memory read in lame_init_params when processing an audio file containing a negative sample rate value, resulting in denial of service via application crash.

Why it matters to the business

Successful exploitation causes service outages for any application that processes untrusted audio files; the affected GitLab Bitnami package was fixed in 13.12.6 and the flaw has seen no meaningful exploitation activity in over nine years.

How an attack unfolds

An attacker creates an audio file whose header specifies a negative sample rate, then causes the target application to invoke lame_init_params on that file; the library performs an out-of-bounds read and crashes.

How to fix it

Upgrade the affected GitLab Bitnami deployment to version 13.12.6 or later; rebuild or replace any other packages that statically link the vulnerable LAME 3.99.5 library.

How to confirm the fix worked

Confirm the installed GitLab Bitnami version is 13.12.6 or newer; attempt to process a test file with a negative sample rate and verify the application no longer crashes.

Typical attack path

1. Craft an audio file containing a negative sample-rate value
2. Deliver the file to an application that uses LAME for decoding or transcoding
3. Trigger initialization of LAME parameters against the malicious file
4. Observe process termination due to invalid memory access

How to detect it

Review application and system logs for segmentation faults or abrupt terminations immediately after audio-file ingestion; correlate crashes with recent file-upload or media-processing events.

What your security team should do

• Apply the 13.12.6 update to GitLab Bitnami instances without delay
• Inventory all systems that embed or depend on LAME and schedule upgrades
• Add audio-processing crash signatures to monitoring rules as a temporary detection measure