PT-2022-2205 · Unknown · Libsndfile

Published 2022-03-28 · Updated 2022-03-28

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libsndfile (affected versions not specified)

Description The issue is related to a buffer overflow in the stack of the guess file type() function in the libsndfile library, which is used for reading and writing audio files. This can be exploited by a remote attacker to cause a stack buffer overflow and potentially execute arbitrary code on the target system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2022-02280

Affected Products

Libsndfile

References · 6

• https://bdu.fstec.ru/vul/2022-02280 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://goslinux.fssp.gov.ru/2726972 · Security Note
• http://github.com/libsndfile/libsndfile/releases/tag/1.1.0 · Note
• https://cve.omp.ru/bb27514 · Note
• http://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29339 · Note