PT-2017-4148 · Libsndfile+3 · Libsndfile+3
Publicado
2017-09-21
·
Atualizado
2024-06-15
·
CVE-2017-14246
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libsndfile version 1.0.28
Description
The issue is related to an out of bounds read in the
d2ulaw array() function in ulaw.c of libsndfile, which may lead to a remote denial of service attack or information disclosure. This is due to the mishandling of the NAN and INFINITY floating-point values. The vulnerability can be exploited by a remote attacker to gain access to confidential data and cause a denial of service.Recommendations
For libsndfile version 1.0.28, consider applying a patch or fix that correctly handles the NAN and INFINITY floating-point values in the
d2ulaw array() function to prevent out of bounds reads. As a temporary workaround, restrict access to the d2ulaw array() function until a patch is available.Correção
DoS
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Ubuntu
Libsndfile