An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4704-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2017-12562)

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 ESM. (CVE-2017-14245, CVE-2017-14246, CVE-2017-14634,     CVE-2017-16942, CVE-2017-6892, CVE-2018-13139, CVE-2018-19432, CVE-2018-19661, CVE-2018-19662,     CVE-2018-19758, CVE-2019-3832)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues have been found in libsndfile, a library for reading/writing audio files. All issues are basically divide by zero errors, heap read overflows or other buffer overlow errors.

For Debian 9 stretch, these problems have been fixed in version 1.0.27-3+deb9u1.

We recommend that you upgrade your libsndfile packages.

For the detailed security status of libsndfile please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libsndfile

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-65 (libsndfile: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libsndfile. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libsndfile version 1.0.28, an error in the     'aiff_read_chanmap()' function (aiff.c) can be     exploited to cause an out-of-bounds read memory access     via a specially crafted AIFF file.(CVE-2017-6892)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile     allows attackers to have unspecified impact via vectors     related to a (1) map offset or (2) rsrc marker, which     triggers an out-of-bounds read.(CVE-2014-9496)

  - The flac_buffer_copy function in flac.c in libsndfile     1.0.28 allows remote attackers to cause a denial of     service (buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     audio file.(CVE-2017-8361)

  - In libsndfile before 1.0.28, an error in the     'flac_buffer_copy()' function (flac.c) can be exploited     to cause a segmentation violation (with write memory     access) via a specially crafted FLAC file during a     resample attempt, a similar issue to     CVE-2017-7585.(CVE-2017-7741)

  - In libsndfile before 1.0.28, an error in the     'flac_buffer_copy()' function (flac.c) can be exploited     to cause a segmentation violation (with read memory     access) via a specially crafted FLAC file during a     resample attempt, a similar issue to     CVE-2017-7585.(CVE-2017-7742)

  - In libsndfile before 1.0.28, an error in the     'flac_buffer_copy()' function (flac.c) can be exploited     to cause a stack-based buffer overflow via a specially     crafted FLAC file.(CVE-2017-7585)

  - An out of bounds read in the function d2ulaw_array() in     ulaw.c of libsndfile 1.0.28 may lead to a remote DoS     attack or information disclosure, related to     mishandling of the NAN and INFINITY floating-point     values.(CVE-2017-14246)

  - An out of bounds read in the function d2alaw_array() in     alaw.c of libsndfile 1.0.28 may lead to a remote DoS     attack or information disclosure, related to     mishandling of the NAN and INFINITY floating-point     values.(CVE-2017-14245)

  - The function d2ulaw_array() in ulaw.c of libsndfile     1.0.29pre1 may lead to a remote DoS attack (SEGV on     unknown address 0x000000000000), a different     vulnerability than CVE-2017-14246.(CVE-2017-17457)

  - The function d2alaw_array() in alaw.c of libsndfile     1.0.29pre1 may lead to a remote DoS attack (SEGV on     unknown address 0x000000000000), a different     vulnerability than CVE-2017-14245.(CVE-2017-17456)

  - In libsndfile 1.0.28, a divide-by-zero error exists in     the function double64_init() in double64.c, which may     lead to DoS when playing a crafted audio     file.(CVE-2017-14634)

  - The psf_fwrite function in file_io.c in libsndfile     allows attackers to cause a denial of service     (divide-by-zero error and application crash) via     unspecified vectors related to the headindex     variable.(CVE-2014-9756)

  - In libsndfile before 1.0.28, an error in the     'header_read()' function (common.c) when handling ID3     tags can be exploited to cause a stack-based buffer     overflow via a specially crafted FLAC     file.(CVE-2017-7586)

  - The flac_buffer_copy function in flac.c in libsndfile     1.0.28 allows remote attackers to cause a denial of     service (invalid read and application crash) via a     crafted audio file.(CVE-2017-8362)

  - The flac_buffer_copy function in flac.c in libsndfile     1.0.28 allows remote attackers to cause a denial of     service (heap-based buffer over-read and application     crash) via a crafted audio file.(CVE-2017-8363)

  - The i2les_array function in pcm.c in libsndfile 1.0.28     allows remote attackers to cause a denial of service     (buffer over-read and application crash) via a crafted     audio file.(CVE-2017-8365)

  - In libsndfile 1.0.25 (fixed in 1.0.26), a     divide-by-zero error exists in the function     wav_w64_read_fmt_chunk() in wav_w64.c, which may lead     to DoS when playing a crafted audio     file.(CVE-2017-16942)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4013-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libsndfile package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out of bounds read in the function d2ulaw_array() in     ulaw.c of libsndfile 1.0.28 may lead to a remote DoS     attack or information disclosure, related to     mishandling of the NAN and INFINITY floating-point     values.(CVE-2017-14246)

  - Heap-based buffer overflow in libsndfile 1.0.25 allows     remote attackers to have unspecified impact via the     headindex value in the header in an AIFF     file.(CVE-2015-7805)

  - An out of bounds read in the function d2alaw_array() in     alaw.c of libsndfile 1.0.28 may lead to a remote DoS     attack or information disclosure, related to     mishandling of the NAN and INFINITY floating-point     values.(CVE-2017-14245)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been found in libsndfile, the library for reading and writing files containing sampled sound.

CVE-2017-8361

The flac_buffer_copy function (flac.c) is affected by a buffer overflow. This vulnerability might be leveraged by remote attackers to cause a denial of service, or possibly have unspecified other impact via a crafted audio file.

CVE-2017-8362

The flac_buffer_copy function (flac.c) is affected by an out-of-bounds read vulnerability. This flaw might be leveraged by remote attackers to cause a denial of service via a crafted audio file.

CVE-2017-8363

The flac_buffer_copy function (flac.c) is affected by a heap based OOB read vulnerability. This flaw might be leveraged by remote attackers to cause a denial of service via a crafted audio file.

CVE-2017-8365

The i2les_array function (pcm.c) is affected by a global buffer overflow. This vulnerability might be leveraged by remote attackers to cause a denial of service, or possibly have unspecified other impact via a crafted audio file.

CVE-2017-14245 CVE-2017-14246 CVE-2017-17456 CVE-2017-17457

The d2alaw_array() and d2ulaw_array() functions (src/ulaw.c and src/alaw.c) are affected by an out-of-bounds read vulnerability. This flaw might be leveraged by remote attackers to cause denial of service or information disclosure via a crafted audio file.

CVE-2017-14634

The double64_init() function (double64.c) is affected by a divide-by-zero error. This vulnerability might be leveraged by remote attackers to cause denial of service via a crafted audio file.

CVE-2018-13139

The psf_memset function (common.c) is affected by a stack-based buffer overflow. This vulnerability might be leveraged by remote attackers to cause a denial of service, or possibly have unspecified other impact via a crafted audio file. The vulnerability can be triggered by the executable sndfile-deinterleave.

CVE-2018-19432

The sf_write_int function (src/sndfile.c) is affected by an out-of-bounds read vulnerability. This flaw might be leveraged by remote attackers to cause a denial of service via a crafted audio file.

CVE-2018-19661 CVE-2018-19662

The i2alaw_array() and i2ulaw_array() functions (src/ulaw.c and src/alaw.c) are affected by an out-of-bounds read vulnerability. This flaw might be leveraged by remote attackers to cause denial of service or information disclosure via a crafted audio file.

For Debian 8 'Jessie', these problems have been fixed in version 1.0.25-9.1+deb8u2.

We recommend that you upgrade your libsndfile packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xin-Jiang on Github reports :

CVE-2017-14245 (Medium): An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.

CVE-2017-14246 (Medium): An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.

my123px on Github reports :

CVE-2017-17456 (Medium): The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14245.

CVE-2017-17457 (Medium): The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14246.

This update for libsndfile fixes the following issues :

  - CVE-2017-16942: Divide-by-zero in the function     wav_w64_read_fmt_chunk(), which may lead to Denial of     service (bsc#1069874). 

  - CVE-2017-6892: Fixed an out-of-bounds read memory access     in the aiff_read_chanmap() (bsc#1043978).

  - CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero     error exists in the function double64_init() in     double64.c, which may lead to DoS when playing a crafted     audio file. (bsc#1059911)

  - CVE-2017-14245: An out of bounds read in the function     d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead     to a remote DoS attack or information disclosure,     related to mishandling of the NAN and INFINITY     floating-point values. (bsc#1059912)

  - CVE-2017-14246: An out of bounds read in the function     d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead     to a remote DoS attack or information disclosure,     related to mishandling of the NAN and INFINITY     floating-point values.(bsc#1059913)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libsndfile fixes the following issues :

  - CVE-2017-16942: Divide-by-zero in the function     wav_w64_read_fmt_chunk(), which may lead to Denial of     service (bsc#1069874).

  - CVE-2017-6892: Fixed an out-of-bounds read memory access     in the aiff_read_chanmap() (bsc#1043978).

  - CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero     error exists in the function double64_init() in     double64.c, which may lead to DoS when playing a crafted     audio file. (bsc#1059911)

  - CVE-2017-14245: An out of bounds read in the function     d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead     to a remote DoS attack or information disclosure,     related to mishandling of the NAN and INFINITY     floating-point values. (bsc#1059912)

  - CVE-2017-14246: An out of bounds read in the function     d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead     to a remote DoS attack or information disclosure,     related to mishandling of the NAN and INFINITY     floating-point values.(bsc#1059913)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- This update for libsndfile fixes a memory leak in an     error path.(bsc#1038856)

  - CVE-2017-16942: A divide-by-zero error exists in the     function wav_w64_read_fmt_chunk() in wav_w64.c, which     may lead to DoS when playing a crafted audio file.
    (bsc#1069874)

  - CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero     error exists in the function double64_init() in     double64.c, which may lead to DoS when playing a crafted     audio file. (bsc#1059911)

  - CVE-2017-14245: An out of bounds read in the function     d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead     to a remote DoS attack or information disclosure,     related to mishandling of the NAN and INFINITY     floating-point values. (bsc#1059912)

  - CVE-2017-14246: An out of bounds read in the function     d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead     to a remote DoS attack or information disclosure,     related to mishandling of the NAN and INFINITY     floating-point values.(bsc#1059913)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out of bounds read in the function d2alaw_array() in     alaw.c of libsndfile 1.0.28 may lead to a remote DoS     attack or information disclosure, related to     mishandling of the NAN and INFINITY floating-point     values.(CVE-2017-14245)

  - An out of bounds read in the function d2ulaw_array() in     ulaw.c of libsndfile 1.0.28 may lead to a remote DoS     attack or information disclosure, related to     mishandling of the NAN and INFINITY floating-point     values.(CVE-2017-14246)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198640	RHEL 6 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198587	RHEL 7 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196344	RHEL 7 : libsndfile (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196321	RHEL 6 : libsndfile (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
145464	Ubuntu 16.04 LTS : libsndfile vulnerabilities (USN-4704-1)	Nessus	Ubuntu Local Security Checks	critical
142107	Debian DLA-2418-1 : libsndfile security update	Nessus	Debian Local Security Checks	high
139273	GLSA-202007-65 : libsndfile: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
130670	EulerOS 2.0 SP5 : libsndfile (EulerOS-SA-2019-2208)	Nessus	Huawei Local Security Checks	high
125812	Ubuntu 16.04 LTS / 18.04 LTS : libsndfile vulnerabilities (USN-4013-1)	Nessus	Ubuntu Local Security Checks	high
124944	EulerOS Virtualization 3.0.1.0 : libsndfile (EulerOS-SA-2019-1441)	Nessus	Huawei Local Security Checks	high
119878	Debian DLA-1618-1 : libsndfile security update	Nessus	Debian Local Security Checks	high
107110	FreeBSD : libsndfile -- out-of-bounds reads (30704aba-1da4-11e8-b6aa-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	high
106664	openSUSE Security Update : libsndfile (openSUSE-2018-140)	Nessus	SuSE Local Security Checks	high
106605	SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2018:0352-1)	Nessus	SuSE Local Security Checks	high
106604	SUSE SLES11 Security Update : Recommended update for libsndfile (SUSE-SU-2018:0351-1)	Nessus	SuSE Local Security Checks	high
103879	EulerOS 2.0 SP2 : libsndfile (EulerOS-SA-2017-1244)	Nessus	Huawei Local Security Checks	high
103878	EulerOS 2.0 SP1 : libsndfile (EulerOS-SA-2017-1243)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2017-14245

high

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high