PT-2009-6670 · Erik De Castro Lopo · Libsndfile1-Dev+2

Alin Rad Pop · Published 1970-01-01 · Updated 2024-06-15 · CVE-2009-0186

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libsndfile versions prior to 1.0.19 libsndfile1-dev (affected versions not specified) sndfile-programs (affected versions not specified)

Description The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely. An integer overflow in libsndfile 1.0.18 allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.

Recommendations For libsndfile versions prior to 1.0.19, update to version 1.0.19 or later to resolve the issue. For libsndfile1-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For sndfile-programs, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-01928

BDU:2015-01929

BDU:2015-01930

BDU:2015-09377

CVE-2009-0186

DSA-1742-1

DTSA-202-1

OPENSUSE-SU-2024:10148-1

OPENSUSE-SU-2024:10470-1

Affected Products

Libsndfile

Libsndfile1-Dev

Sndfile-Programs

References · 39

• https://osv.dev/vulnerability/openSUSE-SU-2024:10148-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0186 · Security Note
• http://security.gentoo.org/glsa/glsa-200904-16.xml · Vendor Advisory
• http://ubuntu.com/usn/USN-749-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10470-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09377 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0186 · Security Note
• http://secunia.com/secunia_research/2009-8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01930 · Security Note
• http://vupen.com/english/advisories/2009/0584 · Vendor Advisory
• http://secunia.com/advisories/33981 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01929 · Security Note
• http://secunia.com/advisories/33980 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0186 · Vendor Advisory