Buffer Over-read Vulnerability in libsndfile by Erik de Castro Lopo
CVE-2018-19662

8.1HIGH

Key Information:

Vendor

Libsndfile Project

Status
Libsndfile
Vendor
CVE Published:
29 November 2018

What is CVE-2018-19662?

An issue has been identified in libsndfile version 1.0.28, specifically in the function i2alaw_array located in alaw.c. This vulnerability leads to a buffer over-read, which can result in a denial of service, affecting the security and stability of applications that utilize this audio file library. Proper measures should be taken to mitigate potential risks associated with this vulnerability.

References

https://lists.debian.org/debian-lts-announce/2018/12/msg0...
mailing-listx_refsource_MLIST
https://github.com/erikd/libsndfile/issues/429
x_refsource_MISC
https://usn.ubuntu.com/4013-1/
vendor-advisoryx_refsource_UBUNTU

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.