There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a denial of service.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: heap-based buffer over-read at wav.c in wav_write_header (CVE-2018-19758)

  - An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function     sf_write_int in sndfile.c, which will lead to a denial of service. (CVE-2018-19432)

  - An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in     ulaw.c that will lead to a denial of service. (CVE-2018-19661)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1166-1 advisory.

  - A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. (CVE-2018-13139)

  - An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function     sf_write_int in sndfile.c, which will lead to a denial of service. (CVE-2018-19432)

  - There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a     denial of service. (CVE-2018-19758)

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2764-1 advisory.

  - A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. (CVE-2018-13139)

  - An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function     sf_write_int in sndfile.c, which will lead to a denial of service. (CVE-2018-19432)

  - There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a     denial of service. (CVE-2018-19758)

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2764-1 advisory.

  - A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. (CVE-2018-13139)

  - An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function     sf_write_int in sndfile.c, which will lead to a denial of service. (CVE-2018-19432)

  - There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a     denial of service. (CVE-2018-19758)

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2615-1 advisory.

  - A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. (CVE-2018-13139)

  - An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function     sf_write_int in sndfile.c, which will lead to a denial of service. (CVE-2018-19432)

  - There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a     denial of service. (CVE-2018-19758)

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4704-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2017-12562)

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 ESM. (CVE-2017-14245, CVE-2017-14246, CVE-2017-14634,     CVE-2017-16942, CVE-2017-6892, CVE-2018-13139, CVE-2018-19432, CVE-2018-19661, CVE-2018-19662,     CVE-2018-19758, CVE-2019-3832)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues have been found in libsndfile, a library for reading/writing audio files. All issues are basically divide by zero errors, heap read overflows or other buffer overlow errors.

For Debian 9 stretch, these problems have been fixed in version 1.0.27-3+deb9u1.

We recommend that you upgrade your libsndfile packages.

For the detailed security status of libsndfile please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libsndfile

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered the fix for CVE-2018-19758     (libsndfile) was not complete and still allows a read     beyond the limits of a buffer in wav_write_header()     function in wav.c. A local attacker may use this flaw     to make the application crash.(CVE-2019-3832)

  - An issue was discovered in libsndfile 1.0.28. There is     a NULL pointer dereference in the function sf_write_int     in sndfile.c, which will lead to a denial of     service.(CVE-2018-19432)

  - There is a heap-based buffer over-read at wav.c in     wav_write_header in libsndfile 1.0.28 that will cause a     denial of service.(CVE-2018-19758)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is a heap-based buffer over-read at wav.c in     wav_write_header in libsndfile 1.0.28 that will cause a     denial of service.(CVE-2018-19758)

  - An issue was discovered in libsndfile 1.0.28. There is     a buffer over-read in the function i2ulaw_array in     ulaw.c that will lead to a denial of     service.(CVE-2018-19661)

  - An issue was discovered in libsndfile 1.0.28. There is     a NULL pointer dereference in the function sf_write_int     in sndfile.c, which will lead to a denial of     service.(CVE-2018-19432)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in libsndfile 1.0.28. There is     a NULL pointer dereference in the function sf_write_int     in sndfile.c, which will lead to a denial of     service.(CVE-2018-19432)

  - There is a heap-based buffer over-read at wav.c in     wav_write_header in libsndfile 1.0.28 that will cause a     denial of service.(CVE-2018-19758)

  - An issue was discovered in libsndfile 1.0.28. There is     a buffer over-read in the function i2ulaw_array in     ulaw.c that will lead to a denial of     service.(CVE-2018-19661)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - There is a heap-based buffer over-read at wav.c in     wav_write_header in libsndfile 1.0.28 that will cause a     denial of service.(CVE-2018-19758)

  - An out of bounds read in the function d2ulaw_array() in     ulaw.c of libsndfile 1.0.28 may lead to a remote DoS     attack or information disclosure, related to     mishandling of the NAN and INFINITY floating-point     values.(CVE-2018-19661)

  - An issue was discovered in libsndfile 1.0.28. There is     a NULL pointer dereference in the function sf_write_int     in sndfile.c, which will lead to a denial of     service.(CVE-2018-19432)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - There is a heap-based buffer over-read at wav.c in     wav_write_header in libsndfile 1.0.28 that will cause a     denial of service.(CVE-2018-19758)

  - An issue was discovered in libsndfile 1.0.28. There is     a buffer over-read in the function i2ulaw_array in     ulaw.c that will lead to a denial of     service.(CVE-2018-19661)

  - An issue was discovered in libsndfile 1.0.28. There is     a NULL pointer dereference in the function sf_write_int     in sndfile.c, which will lead to a denial of     service.(CVE-2018-19432)

  - The function d2ulaw_array() in ulaw.c of libsndfile     1.0.29pre1 may lead to a remote DoS attack (SEGV on     unknown address 0x000000000000), a different     vulnerability than CVE-2017-14246.(CVE-2017-17457)

  - The function d2alaw_array() in alaw.c of libsndfile     1.0.29pre1 may lead to a remote DoS attack (SEGV on     unknown address 0x000000000000), a different     vulnerability than CVE-2017-14245.(CVE-2017-17456)

  - In libsndfile 1.0.28, a divide-by-zero error exists in     the function double64_init() in double64.c, which may     lead to DoS when playing a crafted audio     file.(CVE-2017-14634)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The function d2ulaw_array() in ulaw.c of libsndfile     1.0.29pre1 may lead to a remote DoS attack (SEGV on     unknown address 0x000000000000), a different     vulnerability than CVE-2017-14246.(CVE-2017-17457)

  - The function d2alaw_array() in alaw.c of libsndfile     1.0.29pre1 may lead to a remote DoS attack (SEGV on     unknown address 0x000000000000), a different     vulnerability than CVE-2017-14245.(CVE-2017-17456)

  - In libsndfile 1.0.28, a divide-by-zero error exists in     the function double64_init() in double64.c, which may     lead to DoS when playing a crafted audio     file.(CVE-2017-14634)

  - There is a heap-based buffer over-read at wav.c in     wav_write_header in libsndfile 1.0.28 that will cause a     denial of service.(CVE-2018-19758)

  - An issue was discovered in libsndfile 1.0.28. There is     a buffer over-read in the function i2ulaw_array in     ulaw.c that will lead to a denial of     service.(CVE-2018-19661)

  - An issue was discovered in libsndfile 1.0.28. There is     a NULL pointer dereference in the function sf_write_int     in sndfile.c, which will lead to a denial of     service.(CVE-2018-19432)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4013-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libsndfile fixes the following issues :

Security issues fixed :

CVE-2017-17456: Prevent segmentation fault in the function d2alaw_array() that may have lead to a remote DoS (bsc#1071777).

CVE-2017-17457: Prevent segmentation fault in the function d2ulaw_array() that may have lead to a remote DoS, a different vulnerability than CVE-2017-14246 (bsc#1071767).

CVE-2018-19758: Fixed a heap-based buffer over-read at wav.c in wav_write_header that could have been used for a denial of service attack (bsc#1117954).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-buffer-overflow vulnerability was discovered in libsndfile, the library for reading and writing files containing sampled sound. This flaw might be triggered by remote attackers to cause denial of service (out of bounds read and application crash). 

For Debian 8 'Jessie', this problem has been fixed in version 1.0.25-9.1+deb8u3.

We recommend that you upgrade your libsndfile packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198640	RHEL 6 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198587	RHEL 7 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198581	RHEL 8 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196344	RHEL 7 : libsndfile (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196321	RHEL 6 : libsndfile (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196304	RHEL 8 : libsndfile (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
152693	openSUSE 15 Security Update : libsndfile (openSUSE-SU-2021:1166-1)	Nessus	SuSE Local Security Checks	high
152645	openSUSE 15 Security Update : libsndfile (openSUSE-SU-2021:2764-1)	Nessus	SuSE Local Security Checks	high
152642	SUSE SLED15 / SLES15 Security Update : libsndfile (SUSE-SU-2021:2764-1)	Nessus	SuSE Local Security Checks	high
152246	SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2021:2615-1)	Nessus	SuSE Local Security Checks	high
145464	Ubuntu 16.04 LTS : libsndfile vulnerabilities (USN-4704-1)	Nessus	Ubuntu Local Security Checks	critical
142107	Debian DLA-2418-1 : libsndfile security update	Nessus	Debian Local Security Checks	high
140861	EulerOS 2.0 SP3 : libsndfile (EulerOS-SA-2020-2094)	Nessus	Huawei Local Security Checks	medium
137943	EulerOS Virtualization 3.0.6.0 : libsndfile (EulerOS-SA-2020-1724)	Nessus	Huawei Local Security Checks	medium
137026	EulerOS 2.0 SP5 : libsndfile (EulerOS-SA-2020-1608)	Nessus	Huawei Local Security Checks	medium
136269	EulerOS Virtualization for ARM 64 3.0.2.0 : libsndfile (EulerOS-SA-2020-1566)	Nessus	Huawei Local Security Checks	medium
132820	EulerOS Virtualization for ARM 64 3.0.5.0 : libsndfile (EulerOS-SA-2020-1066)	Nessus	Huawei Local Security Checks	medium
132609	EulerOS 2.0 SP8 : libsndfile (EulerOS-SA-2020-1016)	Nessus	Huawei Local Security Checks	medium
125812	Ubuntu 16.04 LTS / 18.04 LTS : libsndfile vulnerabilities (USN-4013-1)	Nessus	Ubuntu Local Security Checks	high
123674	SUSE SLES11 Security Update : libsndfile (SUSE-SU-2019:14008-1)	Nessus	SuSE Local Security Checks	high
121071	Debian DLA-1632-1 : libsndfile security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-19758

medium

Tenable Plugins

critical

critical

medium

critical

critical

medium

high

high

high

high

critical

high

medium

medium

medium

medium

medium

medium

high

high

medium