CVE-2018-17095
audiofile: Heap-based buffer overflow in Expand3To4Module::run() when running sfconvert
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.
Se ha descubierto un problema en mpruett Audio File Library (también conocido como audiofile) versiones 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. Ha ocurrido un desbordamiento de búfer basado en memoria dinámica (heap) en Expand3To4Module::run al ejecutar sfconvert
It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that audiofile could be made to write out of bounds. If a user or an automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-09-16 CVE Reserved
- 2018-09-16 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-05-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (5)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://github.com/mpruett/audiofile/issues/50 | 2024-08-05 | |
https://github.com/mpruett/audiofile/issues/51 | 2024-08-05 |
URL | Date | SRC |
---|---|---|
https://usn.ubuntu.com/3800-1 | 2021-02-09 |
URL | Date | SRC |
---|---|---|
https://access.redhat.com/security/cve/CVE-2018-17095 | 2020-09-29 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1631088 | 2020-09-29 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Audio File Library Project Search vendor "Audio File Library Project" | Audio File Library Search vendor "Audio File Library Project" for product "Audio File Library" | 0.3.0 Search vendor "Audio File Library Project" for product "Audio File Library" and version "0.3.0" | - |
Affected
| ||||||
Audio File Library Project Search vendor "Audio File Library Project" | Audio File Library Search vendor "Audio File Library Project" for product "Audio File Library" | 0.3.1 Search vendor "Audio File Library Project" for product "Audio File Library" and version "0.3.1" | - |
Affected
| ||||||
Audio File Library Project Search vendor "Audio File Library Project" | Audio File Library Search vendor "Audio File Library Project" for product "Audio File Library" | 0.3.2 Search vendor "Audio File Library Project" for product "Audio File Library" and version "0.3.2" | - |
Affected
| ||||||
Audio File Library Project Search vendor "Audio File Library Project" | Audio File Library Search vendor "Audio File Library Project" for product "Audio File Library" | 0.3.3 Search vendor "Audio File Library Project" for product "Audio File Library" and version "0.3.3" | - |
Affected
| ||||||
Audio File Library Project Search vendor "Audio File Library Project" | Audio File Library Search vendor "Audio File Library Project" for product "Audio File Library" | 0.3.4 Search vendor "Audio File Library Project" for product "Audio File Library" and version "0.3.4" | - |
Affected
| ||||||
Audio File Library Project Search vendor "Audio File Library Project" | Audio File Library Search vendor "Audio File Library Project" for product "Audio File Library" | 0.3.5 Search vendor "Audio File Library Project" for product "Audio File Library" and version "0.3.5" | - |
Affected
| ||||||
Audio File Library Project Search vendor "Audio File Library Project" | Audio File Library Search vendor "Audio File Library Project" for product "Audio File Library" | 0.3.6 Search vendor "Audio File Library Project" for product "Audio File Library" and version "0.3.6" | - |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | esm |
Affected
|