An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1636 advisory.

  - A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. (CVE-2018-13139)

  - An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of service. (CVE-2018-19662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1636 advisory.

    - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function       i2alaw_array in alaw (#1673085)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libsndfile packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of service. (CVE-2018-19662)

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libsndfile packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of service. (CVE-2018-19662)

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2020:1636 advisory.

  - A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. (CVE-2018-13139)

  - An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of service. (CVE-2018-19662)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1636 advisory.

  - libsndfile: stack-based buffer overflow in sndfile-deinterleave utility (CVE-2018-13139)

  - libsndfile: buffer over-read in the function i2alaw_array in alaw.c (CVE-2018-19662)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4704-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2017-12562)

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 ESM. (CVE-2017-14245, CVE-2017-14246, CVE-2017-14634,     CVE-2017-16942, CVE-2017-6892, CVE-2018-13139, CVE-2018-19432, CVE-2018-19661, CVE-2018-19662,     CVE-2018-19758, CVE-2019-3832)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues have been found in libsndfile, a library for reading/writing audio files. All issues are basically divide by zero errors, heap read overflows or other buffer overlow errors.

For Debian 9 stretch, these problems have been fixed in version 1.0.27-3+deb9u1.

We recommend that you upgrade your libsndfile packages.

For the detailed security status of libsndfile please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libsndfile

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1529 advisory.

  - An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of service. (CVE-2018-19662)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libsndfile: buffer over-read in the function     i2alaw_array in alaw.c (CVE-2018-19662)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3922 advisory.

  - An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of service. (CVE-2018-19662)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-3922 advisory.

    [1.0.25-12]
    - fix CVE-2018-19662 - buffer over-read in the function i2alaw_array (#1673086)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3922 advisory.

    libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or     WAV.

    Security Fix(es):

    * libsndfile: buffer over-read in the function i2alaw_array in alaw.c (CVE-2018-19662)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libsndfile package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in libsndfile 1.0.28. There is     a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of     service.(CVE-2018-19662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1636 advisory.

    libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or     WAV.

    Security Fix(es):

    * libsndfile: stack-based buffer overflow in sndfile-deinterleave utility (CVE-2018-13139)

    * libsndfile: buffer over-read in the function i2alaw_array in alaw.c (CVE-2018-19662)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libsndfile package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Heap-based Buffer Overflow in the psf_binheader_writef     function in common.c in libsndfile through 1.0.28     allows remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact.(CVE-2017-12562)

  - It was discovered the fix for CVE-2018-19758     (libsndfile) was not complete and still allows a read     beyond the limits of a buffer in wav_write_header()     function in wav.c. A local attacker may use this flaw     to make the application crash.(CVE-2019-3832)

  - An issue was discovered in libsndfile 1.0.28. There is     a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of     service.(CVE-2018-19662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4013-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in libsndfile 1.0.28. There is     a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of     service.(CVE-2018-19662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been found in libsndfile, the library for reading and writing files containing sampled sound.

CVE-2017-8361

The flac_buffer_copy function (flac.c) is affected by a buffer overflow. This vulnerability might be leveraged by remote attackers to cause a denial of service, or possibly have unspecified other impact via a crafted audio file.

CVE-2017-8362

The flac_buffer_copy function (flac.c) is affected by an out-of-bounds read vulnerability. This flaw might be leveraged by remote attackers to cause a denial of service via a crafted audio file.

CVE-2017-8363

The flac_buffer_copy function (flac.c) is affected by a heap based OOB read vulnerability. This flaw might be leveraged by remote attackers to cause a denial of service via a crafted audio file.

CVE-2017-8365

The i2les_array function (pcm.c) is affected by a global buffer overflow. This vulnerability might be leveraged by remote attackers to cause a denial of service, or possibly have unspecified other impact via a crafted audio file.

CVE-2017-14245 CVE-2017-14246 CVE-2017-17456 CVE-2017-17457

The d2alaw_array() and d2ulaw_array() functions (src/ulaw.c and src/alaw.c) are affected by an out-of-bounds read vulnerability. This flaw might be leveraged by remote attackers to cause denial of service or information disclosure via a crafted audio file.

CVE-2017-14634

The double64_init() function (double64.c) is affected by a divide-by-zero error. This vulnerability might be leveraged by remote attackers to cause denial of service via a crafted audio file.

CVE-2018-13139

The psf_memset function (common.c) is affected by a stack-based buffer overflow. This vulnerability might be leveraged by remote attackers to cause a denial of service, or possibly have unspecified other impact via a crafted audio file. The vulnerability can be triggered by the executable sndfile-deinterleave.

CVE-2018-19432

The sf_write_int function (src/sndfile.c) is affected by an out-of-bounds read vulnerability. This flaw might be leveraged by remote attackers to cause a denial of service via a crafted audio file.

CVE-2018-19661 CVE-2018-19662

The i2alaw_array() and i2ulaw_array() functions (src/ulaw.c and src/alaw.c) are affected by an out-of-bounds read vulnerability. This flaw might be leveraged by remote attackers to cause denial of service or information disclosure via a crafted audio file.

For Debian 8 'Jessie', these problems have been fixed in version 1.0.25-9.1+deb8u2.

We recommend that you upgrade your libsndfile packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198640	RHEL 6 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196321	RHEL 6 : libsndfile (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
184503	Rocky Linux 8 : libsndfile (RLSA-2020:1636)	Nessus	Rocky Linux Local Security Checks	high
180978	Oracle Linux 8 : libsndfile (ELSA-2020-1636)	Nessus	Oracle Linux Local Security Checks	high
160829	NewStart CGSL CORE 5.05 / MAIN 5.05 : libsndfile Multiple Vulnerabilities (NS-SA-2022-0045)	Nessus	NewStart CGSL Local Security Checks	high
160780	NewStart CGSL CORE 5.04 / MAIN 5.04 : libsndfile Multiple Vulnerabilities (NS-SA-2022-0014)	Nessus	NewStart CGSL Local Security Checks	high
157618	AlmaLinux 8 : libsndfile (ALSA-2020:1636)	Nessus	Alma Linux Local Security Checks	high
145991	CentOS 8 : libsndfile (CESA-2020:1636)	Nessus	CentOS Local Security Checks	high
145464	Ubuntu 16.04 LTS : libsndfile vulnerabilities (USN-4704-1)	Nessus	Ubuntu Local Security Checks	critical
142107	Debian DLA-2418-1 : libsndfile security update	Nessus	Debian Local Security Checks	high
141956	Amazon Linux 2 : libsndfile (ALAS-2020-1529)	Nessus	Amazon Linux Local Security Checks	high
141650	Scientific Linux Security Update : libsndfile on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	high
141604	CentOS 7 : libsndfile (RHSA-2020:3922)	Nessus	CentOS Local Security Checks	high
141253	Oracle Linux 7 : libsndfile (ELSA-2020-3922)	Nessus	Oracle Linux Local Security Checks	high
141050	RHEL 7 : libsndfile (RHSA-2020:3922)	Nessus	Red Hat Local Security Checks	high
140360	EulerOS Virtualization for ARM 64 3.0.2.0 : libsndfile (EulerOS-SA-2020-1990)	Nessus	Huawei Local Security Checks	high
136042	RHEL 8 : libsndfile (RHSA-2020:1636)	Nessus	Red Hat Local Security Checks	high
131516	EulerOS Virtualization for ARM 64 3.0.3.0 : libsndfile (EulerOS-SA-2019-2351)	Nessus	Huawei Local Security Checks	critical
125812	Ubuntu 16.04 LTS / 18.04 LTS : libsndfile vulnerabilities (USN-4013-1)	Nessus	Ubuntu Local Security Checks	high
125518	EulerOS 2.0 SP3 : libsndfile (EulerOS-SA-2019-1591)	Nessus	Huawei Local Security Checks	high
125517	EulerOS 2.0 SP2 : libsndfile (EulerOS-SA-2019-1590)	Nessus	Huawei Local Security Checks	high
119878	Debian DLA-1618-1 : libsndfile security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-19662

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

critical

high

high

high

high