Remote Denial of Service in libsndfile Audio Processing Library
CVE-2017-8362

6.5MEDIUM

Key Information:

Vendor

Libsndfile Project

Status
Libsndfile
Vendor
CVE Published:
30 April 2017

What is CVE-2017-8362?

The flac_buffer_copy function within the libsndfile library (version 1.0.28) is susceptible to a denial of service attack. By supplying a specially crafted audio file, remote attackers can trigger an invalid memory read, which may lead to an application crash. This vulnerability highlights the risks associated with improper handling of audio data processing, making it critical for developers to validate input thoroughly to prevent such exploits.

References

https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invali...
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018/12/msg0...
mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201811-23
vendor-advisoryx_refsource_GENTOO

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.