ID CVE-2017-6838
Summary Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.
References
Vulnerable Configurations
  • cpe:2.3:a:audiofile:audiofile:0.3.6
    cpe:2.3:a:audiofile:audiofile:0.3.6
CVSS
Base: 4.3 (as of 22-03-2017 - 10:43)
Impact:
Exploitability:
CWE CWE-190
CAPEC
  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-1182-1.NASL
    description This update for audiofile fixes the following issues: Security issues fixed : - CVE-2017-6827: heap-based buffer overflow in MSADPCM::initializeCoefficients (MSADPCM.cpp) (bsc#1026979) - CVE-2017-6828: heap-based buffer overflow in readValue (FileHandle.cpp) (bsc#1026980) - CVE-2017-6829: global buffer overflow in decodeSample (IMA.cpp) (bsc#1026981) - CVE-2017-6830: heap-based buffer overflow in alaw2linear_buf (G711.cpp) (bsc#1026982) - CVE-2017-6831: heap-based buffer overflow in IMA::decodeBlockWAVE (IMA.cpp) (bsc#1026983) - CVE-2017-6832: heap-based buffer overflow in MSADPCM::decodeBlock (MSADPCM.cpp) (bsc#1026984) - CVE-2017-6833: divide-by-zero in BlockCodec::runPull (BlockCodec.cpp) (bsc#1026985) - CVE-2017-6834: heap-based buffer overflow in ulaw2linear_buf (G711.cpp) (bsc#1026986) - CVE-2017-6835: divide-by-zero in BlockCodec::reset1 (BlockCodec.cpp) (bsc#1026988) - CVE-2017-6836: heap-based buffer overflow in Expand3To4Module::run (SimpleModule.h) (bsc#1026987) - CVE-2017-6837, CVE-2017-6838, CVE-2017-6839: multiple ubsan crashes (bsc#1026978) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-08
    plugin id 100022
    published 2017-05-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100022
    title SUSE SLES11 Security Update : audiofile (SUSE-SU-2017:1182-1)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3241-1.NASL
    description Agostino Sarubbo discovered that audiofile incorrectly handled certain malformed audio files. If a user or automated system were tricked into processing a specially crafted audio file, a remote attacker could cause applications linked against audiofile to crash, leading to a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-03-28
    plugin id 97917
    published 2017-03-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97917
    title Ubuntu 12.04 LTS / 14.04 LTS : audiofile vulnerabilities (USN-3241-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-867.NASL
    description Multiple vulnerabilities has been found in audiofile. CVE-2017-6829 Allows remote attackers to cause a denial of service (crash) via a crafted file. CVE-2017-6830, CVE-2017-6834, CVE-2017-6831, CVE-2017-6832, CVE-2017-6838, CVE-2017-6839, CVE-2017-6836 Heap-based buffer overflow in that allows remote attackers to cause a denial of service (crash) via a crafted file. CVE-2017-6833, CVE-2017-6835 The runPull function allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file. CVE-2017-6837 Allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coefficients. For Debian 7 'Wheezy', these problems have been fixed in version 0.3.4-2+deb7u1. We recommend that you upgrade your audiofile packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-08-14
    plugin id 97921
    published 2017-03-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97921
    title Debian DLA-867-1 : audiofile security update
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0940-1.NASL
    description This audiofile update fixes the following issue: Security issues fixed : - CVE-2015-7747: Fixed buffer overflow issue when changing both number of channels and sample format. (bsc#949399) - CVE-2017-6827: heap-based buffer overflow in MSADPCM::initializeCoefficients (MSADPCM.cpp) (bsc#1026979) - CVE-2017-6828: heap-based buffer overflow in readValue (FileHandle.cpp) (bsc#1026980) - CVE-2017-6829: global buffer overflow in decodeSample (IMA.cpp) (bsc#1026981) - CVE-2017-6830: heap-based buffer overflow in alaw2linear_buf (G711.cpp) (bsc#1026982) - CVE-2017-6831: heap-based buffer overflow in IMA::decodeBlockWAVE (IMA.cpp) (bsc#1026983) - CVE-2017-6832: heap-based buffer overflow in MSADPCM::decodeBlock (MSADPCM.cpp) (bsc#1026984) - CVE-2017-6833: divide-by-zero in BlockCodec::runPull (BlockCodec.cpp) (bsc#1026985) - CVE-2017-6834: heap-based buffer overflow in ulaw2linear_buf (G711.cpp) (bsc#1026986) - CVE-2017-6835: divide-by-zero in BlockCodec::reset1 (BlockCodec.cpp) (bsc#1026988) - CVE-2017-6836: heap-based buffer overflow in Expand3To4Module::run (SimpleModule.h) (bsc#1026987) - CVE-2017-6837, CVE-2017-6838, CVE-2017-6839: multiple ubsan crashes (bsc#1026978) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-04-06
    plugin id 99230
    published 2017-04-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99230
    title SUSE SLED12 / SLES12 Security Update : audiofile (SUSE-SU-2017:0940-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-476.NASL
    description This audiofile update fixes the following issue : Security issues fixed : - CVE-2017-6827: heap-based buffer overflow in MSADPCM::initializeCoefficients (MSADPCM.cpp) (bsc#1026979) - CVE-2017-6828: heap-based buffer overflow in readValue (FileHandle.cpp) (bsc#1026980) - CVE-2017-6829: global buffer overflow in decodeSample (IMA.cpp) (bsc#1026981) - CVE-2017-6830: heap-based buffer overflow in alaw2linear_buf (G711.cpp) (bsc#1026982) - CVE-2017-6831: heap-based buffer overflow in IMA::decodeBlockWAVE (IMA.cpp) (bsc#1026983) - CVE-2017-6832: heap-based buffer overflow in MSADPCM::decodeBlock (MSADPCM.cpp) (bsc#1026984) - CVE-2017-6833: divide-by-zero in BlockCodec::runPull (BlockCodec.cpp) (bsc#1026985) - CVE-2017-6834: heap-based buffer overflow in ulaw2linear_buf (G711.cpp) (bsc#1026986) - CVE-2017-6835: divide-by-zero in BlockCodec::reset1 (BlockCodec.cpp) (bsc#1026988) - CVE-2017-6836: heap-based buffer overflow in Expand3To4Module::run (SimpleModule.h) (bsc#1026987) - CVE-2017-6837, CVE-2017-6838, CVE-2017-6839: multiple ubsan crashes (bsc#1026978) This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2017-10-29
    modified 2017-04-20
    plugin id 99427
    published 2017-04-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99427
    title openSUSE Security Update : audiofile (openSUSE-2017-476)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3814.NASL
    description Several vulnerabilities have been discovered in the audiofile library, which may result in denial of service or the execution of arbitrary code if a malformed audio file is processed.
    last seen 2017-10-29
    modified 2017-03-28
    plugin id 97900
    published 2017-03-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97900
    title Debian DSA-3814-1 : audiofile - security update
refmap via4
debian DSA-3814
misc
mlist [oss-security] 20170313 Re: audiofile: multiple ubsan crashes
Last major update 22-03-2017 - 13:09
Published 20-03-2017 - 12:59
Last modified 03-11-2017 - 21:29
Back to Top