PT-2010-1643 · Erik De Castro Lopo · Libsndfile

Sami Liedes · Published 2010-05-05 · Updated 2010-05-11 · CVE-2009-4835

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libsndfile version 1.0.20

Description The issue allows context-dependent attackers to cause a denial of service, resulting in a divide-by-zero error and application crash, via a crafted audio file. This is due to vulnerabilities in several functions, including htk read header, alaw init, ulaw init, pcm init, float32 init, and sds read header.

Recommendations For libsndfile version 1.0.20, consider disabling the use of the vulnerable functions until a patch is available. Restrict access to crafted audio files to minimize the risk of exploitation. Avoid using the vulnerable functions in the affected library until the issue is resolved.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-4835

Affected Products

Libsndfile

References · 8

• https://osv.dev/vulnerability/CVE-2009-4835 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1446 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-4835 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-4835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4835 · Security Note
• http://secunia.com/advisories/35266 · Vendor Advisory
• http://securityfocus.com/bid/35126 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530831 · Note