CVE-2024-50612 — Out-of-bounds Read in Libsndfile

CWE-125 — Out-of-bounds Read10 documents7 sources
Severity
5.5MEDIUMNVD
OSV7.1
EPSS
0.0%
top 94.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Libsndfile Project LibsndfileDebian LibsndfileMsrc Azl3 Libsndfile 1.2.2-3 ON Azure Linux 3.0+2 more
Timeline
PublishedOct 27
Latest updateFeb 25

Description

libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages7 packages

▶debiandebian/libsndfile< libsndfile 1.2.0-1+deb12u1 (bookworm)
▶Debianlibsndfile_project/libsndfile< 1.0.31-2+deb11u1+3
▶Ubuntulibsndfile_project/libsndfile< 1.0.28-7ubuntu0.3+3

🔴Vulnerability Details

3
OSV
libsndfile vulnerabilities↗2025-02-18
▶
GHSA
GHSA-cq86-p348-qr4p: libsndfile through 1↗2024-10-28
▶
OSV
CVE-2024-50612: libsndfile through 1↗2024-10-27
▶

📋Vendor Advisories

6
Ubuntu
libsndfile vulnerability↗2025-02-25
▶
Ubuntu
libsndfile vulnerabilities↗2025-02-18
▶
Ubuntu
libsndfile vulnerability↗2025-02-13
▶
Red Hat
libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote()↗2024-10-27
▶
Microsoft
libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.↗2024-10-08
▶