OESA-2021-1040

Dashboard / Vulnerabilities / OESA-2021-1040

OESA-2021-1040

Summary: audiofile security update

Details: The Audio File Library is a C-based library for reading and writing audio files in many common formats. The Audio File Library provides a uniform API which abstracts away details of file formats and data formats. The same calls for opening a file, accessing and manipulating audio metadata (e.g. sample rate, sample format, textual information, MIDI parameters), and reading and writing sample data will work with any supported audio file format. Security Fix(es): Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted WAV file.(CVE-2017-6828) Integer overflow in modules/MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.(CVE-2017-6839) Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.(CVE-2017-6838) Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.(CVE-2017-6831) The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.(CVE-2017-6829)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1040, https://nvd.nist.gov/vuln/detail/CVE-2017-6828, https://nvd.nist.gov/vuln/detail/CVE-2017-6839, https://nvd.nist.gov/vuln/detail/CVE-2017-6838, https://nvd.nist.gov/vuln/detail/CVE-2017-6831, https://nvd.nist.gov/vuln/detail/CVE-2017-6829