Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

fix CVE-2015-7805 libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The libsndfile package was updated to fix the following security issue :

  - CVE-2014-9756: Fixed a divide by zero problem that can     lead to a Denial of Service (DoS) (bsc#953521).

  - CVE-2015-7805: Fixed heap overflow issue (bsc#953516).

  - CVE-2015-8075: Fixed heap overflow issue (bsc#953519).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The libsndfile package was updated to fix the following security issue :

  - CVE-2014-9756: Fixed a divide by zero problem that can     lead to a Denial of Service (DoS) (bsc#953521).

  - CVE-2015-7805: Fixed heap overflow issue (bsc#953516).

  - CVE-2015-8075: Fixed heap overflow issue (bsc#953519).

The libsndfile package was updated to fix three security issues :

  - CVE-2015-7805: fix for heap overflow via specially     crafted AIFF header (bsc#953516)

  - CVE-2015-8075: fix for out of bounds read access in     function psf_strlcpy_crlf (bsc#953519)

  - CVE-2014-9756: fix a divide-by-zero issue that can lead     to an DoS (bsc#953521)

ID	Name	Product	Family	Severity
198640	RHEL 6 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198587	RHEL 7 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
89284	Fedora 23 : libsndfile-1.0.25-18.fc23 (2015-71b291686c)	Nessus	Fedora Local Security Checks	high
89140	Fedora 22 : libsndfile-1.0.25-18.fc22 (2015-0be7a2e1b8)	Nessus	Fedora Local Security Checks	high
87642	SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2015:2000-2)	Nessus	SuSE Local Security Checks	high
87084	openSUSE Security Update : libsndfile (openSUSE-2015-820)	Nessus	SuSE Local Security Checks	high
86895	SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2015:2000-1)	Nessus	SuSE Local Security Checks	high
86891	openSUSE Security Update : libsndfile (openSUSE-2015-742)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8075

No Score

Tenable Plugins

critical

critical

high

high

high

high

high

high