PT-2019-2953 · Sox+4 · Sox+4
Hendra Gunadi
·
Publicado
2019-06-28
·
Atualizado
2025-01-10
·
CVE-2019-13590
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
SoX version 14.4.2
Description
An issue in the
startread function of sox-fmt.h in the libsox.a library of SoX leads to an integer overflow, resulting in a NULL pointer being returned from the lsx calloc macro, which wraps malloc. This NULL pointer is then used without validation, causing a NULL pointer dereference in lsx readbuf in formats i.c. The vulnerability can be exploited by a remote attacker to cause a denial of service.Recommendations
For SoX version 14.4.2, as a temporary workaround, consider restricting the use of the
startread function in sox-fmt.h until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
NULL Pointer Dereference
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Linuxmint
Sox
Ubuntu