Comment 48 for bug 218652

xiph's (lib)speex 1.2 beta 3.2 has been tagged that fixes CVE-2008-1686 directly in the the speex_header_to_packet() function which applications use. Sanitations inside applications are therefore unnecessary.

Patch:
  https://trac.xiph.org/changeset/14701