user/sox: multiple vulnerabilities
Bugzilla ID | 166 |
Alias(es) | CVE-2017-11332, CVE-2017-11358, CVE-2017-11359, CVE-2017-15370, CVE-2017-15371, CVE-2017-15372, CVE-2017-15642, CVE-2017-18189, CVE-2019-1010004, CVE-2019-13590, CVE-2019-8354, CVE-2019-8355, CVE-2019-8356, CVE-2019-8357 |
Reporter | Max Rees (sroracle) |
Assignee | Max Rees (sroracle) |
Reported | 2019-07-31 11:06:44 -0500 |
Modified | 2020-03-29 02:24:40 -0500 |
Status | RESOLVED FIXED |
Version | 1.0-BETA3 |
Hardware | Adélie Linux / All |
Importance | --- / normal |
Description
CVE-2017-11332: https://nvd.nist.gov/vuln/detail/CVE-2017-11332
The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows
remote attackers to cause a denial of service (divide-by-zero error
and application crash) via a crafted wav file.
CVE-2017-11358: https://nvd.nist.gov/vuln/detail/CVE-2017-11358
The read_samples function in hcom.c in Sound eXchange (SoX) 14.4.2
allows remote attackers to cause a denial of service (invalid memory
read and application crash) via a crafted hcom file.
CVE-2017-11359: https://nvd.nist.gov/vuln/detail/CVE-2017-11359
The wavwritehdr function in wav.c in Sound eXchange (SoX) 14.4.2
allows remote attackers to cause a denial of service (divide-by-zero
error and application crash) via a crafted snd file, during conversion
to a wav file.
CVE-2017-15370: https://nvd.nist.gov/vuln/detail/CVE-2017-15370
There is a heap-based buffer overflow in the ImaExpandS function of
ima_rw.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to
a denial of service attack during conversion of an audio file.
CVE-2017-15371: https://nvd.nist.gov/vuln/detail/CVE-2017-15371
There is a reachable assertion abort in the function
sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2. A
Crafted input will lead to a denial of service attack during
conversion of an audio file.
CVE-2017-15372: https://nvd.nist.gov/vuln/detail/CVE-2017-15372
There is a stack-based buffer overflow in the
lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange
(SoX) 14.4.2. A Crafted input will lead to a denial of service attack
during conversion of an audio file.
CVE-2017-15642: https://nvd.nist.gov/vuln/detail/CVE-2017-15642
In lsx_aiffstartread in aiff.c in Sound eXchange (SoX) 14.4.2, there
is a Use-After-Free vulnerability triggered by supplying a malformed
AIFF file.
CVE-2017-18189: https://nvd.nist.gov/vuln/detail/CVE-2017-18189
In the startread function in xa.c in Sound eXchange (SoX) through
14.4.2, a corrupt header specifying zero channels triggers an infinite
loop with a resultant NULL pointer dereference, which may allow a
remote attacker to cause a denial-of-service.
CVE-2019-1010004: https://nvd.nist.gov/vuln/detail/CVE-2019-1010004
SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds
Read. The impact is: Denial of Service. The component is: read_samples
function at xa.c:219. The attack vector is: Victim must open specially
crafted .xa file. NOTE: this may overlap CVE-2017-18189.
CVE-2019-8354: https://nvd.nist.gov/vuln/detail/CVE-2019-8354
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c
has an integer overflow on the result of multiplication fed into
malloc. When the buffer is allocated, it is smaller than expected,
leading to a heap-based buffer overflow.
CVE-2019-8355: https://nvd.nist.gov/vuln/detail/CVE-2019-8355
An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an
integer overflow on the result of multiplication fed into the
lsx_valloc macro that wraps malloc. When the buffer is allocated, it
is smaller than expected, leading to a heap-based buffer overflow in
channels_start in remix.c.
CVE-2019-8356: https://nvd.nist.gov/vuln/detail/CVE-2019-8356
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2
in fft4g.c is not guarded, such that it can lead to write access
outside of the statically declared array, aka a stack-based buffer
overflow.
CVE-2019-8357: https://nvd.nist.gov/vuln/detail/CVE-2019-8357
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c
allows a NULL pointer dereference.
CVE-2019-13590: https://nvd.nist.gov/vuln/detail/CVE-2019-13590
An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h
(startread function), there is an integer overflow on the result of
integer addition (wraparound to 0) fed into the lsx_calloc macro that
wraps malloc. When a NULL pointer is returned, it is used without a
prior check that it is a valid pointer, leading to a NULL pointer
dereference on lsx_readbuf in formats_i.c.