PT-2018-6720 · Sox+2 · Sound Exchange+2

Mans Rullgard · Published 2018-02-15 · Updated 2024-06-15 · CVE-2017-18189

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Sound eXchange (SoX) versions 14.4.2 and earlier

Description: The issue is related to a corrupt header that specifies zero channels, triggering an infinite loop and a resultant NULL pointer dereference in the startread function in xa.c. This may allow a remote attacker to cause a denial-of-service.

Recommendations: For versions 14.4.2 and earlier, update to a version that fixes the issue in the startread function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CESA-2019_2283

CVE-2017-18189

DLA-1197-1

DLA-1695-1

MGASA-2018-0211

OPENSUSE-SU-2018:0489-1

OPENSUSE-SU-2018:0493-1

OPENSUSE-SU-2024:11394-1

RHSA-2019:2283

RHSA-2019_2283

Affected Products

Centos

Red Hat

Sound Exchange

References · 37

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881121 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2018:0489-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0211 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2283 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1695-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62RARFRXGKPNNFFNVDV7DHJSOKAIZ3CX · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11394-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0211.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-18189 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:0493-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-18189 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-18189 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-18189 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18189 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18189 · Vendor Advisory