PT-2017-4148 · Libsndfile+3 · Libsndfile+3
Published
2017-09-21
·
Updated
2024-06-15
·
CVE-2017-14246
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libsndfile version 1.0.28
Description
The issue is related to an out of bounds read in the
d2ulaw array() function in ulaw.c of libsndfile, which may lead to a remote denial of service attack or information disclosure. This is due to the mishandling of the NAN and INFINITY floating-point values. The vulnerability can be exploited by a remote attacker to gain access to confidential data and cause a denial of service.Recommendations
For libsndfile version 1.0.28, consider applying a patch or fix that correctly handles the NAN and INFINITY floating-point values in the
d2ulaw array() function to prevent out of bounds reads. As a temporary workaround, restrict access to the d2ulaw array() function until a patch is available.Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Suse
Ubuntu
Libsndfile