CVE-2017-7586 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libsndfile

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-121 — Stack-based Buffer Overflow8 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.3%
top 43.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Libsndfile Project LibsndfileDebian Libsndfile
Timeline
PublishedApr 7
Latest updateMay 17

Description

In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/libsndfile< libsndfile 1.0.27-2 (bookworm)
▶Debianlibsndfile_project/libsndfile< 1.0.27-2+3

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-5jpx-m5hp-3gpv: In libsndfile before 1↗2022-05-17
▶
OSV
CVE-2017-7586: In libsndfile before 1↗2017-04-07
▶

📋Vendor Advisories

3
Ubuntu
libsndfile vulnerabilities↗2017-06-01
▶
Red Hat
libsndfile: Error in header_read() causing stack-based buffer overflow↗2017-03-26
▶
Debian
CVE-2017-7586: libsndfile - In libsndfile before 1.0.28, an error in the "header_read()" function (common.c)...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-7586 libsndfile: Error in header_read() causing stack-based buffer overflow↗2017-04-10
▶
Bugzilla
CVE-2017-7585 CVE-2017-7586 libsndfile: various flaws [fedora-all]↗2017-04-10
▶