PT-2010-1643 · Erik De Castro Lopo · Libsndfile

Sami Liedes · Publicado 2010-05-05 · Atualizado 2010-05-11 · CVE-2009-4835

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libsndfile version 1.0.20

Description The issue allows context-dependent attackers to cause a denial of service, resulting in a divide-by-zero error and application crash, via a crafted audio file. This is due to vulnerabilities in several functions, including htk read header, alaw init, ulaw init, pcm init, float32 init, and sds read header.

Recommendations For libsndfile version 1.0.20, consider disabling the use of the vulnerable functions until a patch is available. Restrict access to crafted audio files to minimize the risk of exploitation. Avoid using the vulnerable functions in the affected library until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-4835

Produtos afetados

Libsndfile

Referências · 8

• https://osv.dev/vulnerability/CVE-2009-4835 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1446 · Aviso do Fabricante
• http://securityfocus.com/bid/35126 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-4835 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-4835 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4835 · Nota de Segurança
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530831 · Nota
• http://secunia.com/advisories/35266 · Aviso do Fabricante