CVE-2011-2696 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libsndfile

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-190 — Integer Overflow or Wraparound7 documents7 sources
Severity
6.8MEDIUMNVD
EPSS
8.9%
top 7.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libsndfile Project LibsndfileDebian LibsndfileMega-nerd Libsndfile
Timeline
PublishedJul 27
Latest updateMay 17

Description

Integer overflow in libsndfile before 1.0.25 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PARIS Audio Format (PAF) file that triggers a heap-based buffer overflow.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/libsndfile< libsndfile 1.0.25-1 (bookworm)
▶Debianlibsndfile_project/libsndfile< 1.0.25-1+3
▶NVDmega-nerd/libsndfile1.0.24+26

🔴Vulnerability Details

2
GHSA
GHSA-pq4x-r6mp-pmm3: Integer overflow in libsndfile before 1↗2022-05-17
▶
OSV
CVE-2011-2696: Integer overflow in libsndfile before 1↗2011-07-27
▶

📋Vendor Advisories

3
Ubuntu
libsndfile vulnerability↗2011-07-25
▶
Red Hat
libsndfile: Application crash due integer overflow by processing certain PAF audio files↗2011-07-12
▶
Debian
CVE-2011-2696: libsndfile - Integer overflow in libsndfile before 1.0.25 allows remote attackers to cause a ...↗2011
▶

💬Community

1
Bugzilla
CVE-2011-2696 libsndfile: Application crash due integer overflow by processing certain PAF audio files↗2011-07-14
▶