SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sox: two heap out-of-bounds access issues (oCERT-2014-010) (CVE-2014-8145)

  - sox: null pointer dereference in function lsx_make_lpf in effect_i_dsp.c (CVE-2019-8357)

  - The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial     of service (divide-by-zero error and application crash) via a crafted wav file. (CVE-2017-11332)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Detections

Analytics

CVE-2019-1010004

medium

Tenable Plugins

medium