CVE-2005-0087
published 2005-04-27CVE-2005-0087: The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code…
PriorityP417medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.45%
36.6th percentile
The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| alsa-project | alsa-lib | — | — |
| alsa-project | alsa-lib | >= 0 < 1.0.9-1 | 1.0.9-1 |
| alsa-project | alsa-lib | >= 0 < 1.0.9-1 | 1.0.9-1 |
| alsa-project | alsa-lib | >= 0 < 1.0.9-1 | 1.0.9-1 |
| alsa-project | alsa-lib | >= 0 < 1.0.9-1 | 1.0.9-1 |
| debian | alsa-lib | < alsa-lib 1.0.9-1 (bookworm) | alsa-lib 1.0.9-1 (bookworm) |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv4.6MEDIUM
vendor_debian4.6LOW
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6mvg-c283-q7q6: The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound
ghsa_unreviewed·2022-05-01
CVE-2005-0087 [MEDIUM] GHSA-6mvg-c283-q7q6: The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound
The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.
OSV
CVE-2005-0087: The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound
osv·2005-04-27·CVSS 4.6
CVE-2005-0087 [MEDIUM] CVE-2005-0087: The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound
The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.
Red Hat
security flaw
vendor_redhat·2005-02-15·CVSS 4.6
CVE-2005-0087 [MEDIUM] security flaw
security flaw
The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.
Debian
CVE-2005-0087: alsa-lib - The alsa-lib package in Red Hat Linux 4 disables stack protection for the libaso...
vendor_debian·2005·CVSS 4.6
CVE-2005-0087 [MEDIUM] CVE-2005-0087: alsa-lib - The alsa-lib package in Red Hat Linux 4 disables stack protection for the libaso...
The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.
Scope: local
bookworm: resolved (fixed in 1.0.9-1)
bullseye: resolved (fixed in 1.0.9-1)
forky: resolved (fixed in 1.0.9-1)
sid: resolved (fixed in 1.0.9-1)
trixie: resolved (fixed in 1.0.9-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2005-0087 security flaw
bugzilla·2018-08-16·CVSS 4.6
CVE-2005-0087 [MEDIUM] CVE-2005-0087 security flaw
CVE-2005-0087 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.
Bugzilla
CAN-2005-0087 alsa-lib disables stack protection for it's users
bugzilla·2005-01-07
[HIGH] CAN-2005-0087 alsa-lib disables stack protection for it's users
CAN-2005-0087 alsa-lib disables stack protection for it's users
Description of problem:
libasound.so will disable the stack execution protection for all the apps using
it, which is quite a big chunk of our desktop apps.
The cause is a bit of evil code in src/mixer/mixer.c
I will attach a patch to fix this.
Note that this is a rather serious security issue due to the effect of disabling
stack protection (both execshield segment and NX) for a wide range of
applications at once.
Discussion:
Created attachment 109498
patch to fix this issue
---
I'm assigning this issue CAN-2005-0087 as it borderline qualifies for
a CVE name under the definition of "exposure". Since this has the
potential to disable stack execution protection for a large number of
applications, it's violating a reasonab
2005-04-27
Published