An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function), there is an integer overflow on the result of integer addition (wraparound to 0) fed into the lsx_calloc macro that wraps malloc. When a NULL pointer is returned, it is used without a prior check that it is a valid pointer, leading to a NULL pointer dereference on lsx_readbuf in formats_i.c.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0329-1 advisory.

  - An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function), there is an integer     overflow on the result of integer addition (wraparound to 0) fed into the lsx_calloc macro that wraps     malloc. When a NULL pointer is returned, it is used without a prior check that it is a valid pointer,     leading to a NULL pointer dereference on lsx_readbuf in formats_i.c. (CVE-2019-13590)

  - A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in     formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to     crash. (CVE-2021-23159)

  - A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c     file. An attacker with a crafted wav file, could cause an application to crash. (CVE-2021-33844)

  - A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-     overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive     information. (CVE-2021-3643)

  - A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound     Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer     overflow. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-40426)

  - In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
    (CVE-2022-31650)

  - In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a. (CVE-2022-31651)

  - A floating point exception vulnerability was found in sox, in the read_samples function at     sox/src/voc.c:334:18. This flaw can lead to a denial of service. (CVE-2023-32627)

  - A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41.
    This flaw can lead to a denial of service, code execution, or information disclosure. (CVE-2023-34318)

  - A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at     sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information     disclosure. (CVE-2023-34432)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0328-1 advisory.

  - An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function), there is an integer     overflow on the result of integer addition (wraparound to 0) fed into the lsx_calloc macro that wraps     malloc. When a NULL pointer is returned, it is used without a prior check that it is a valid pointer,     leading to a NULL pointer dereference on lsx_readbuf in formats_i.c. (CVE-2019-13590)

  - A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in     formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to     crash. (CVE-2021-23159)

  - A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c     file. An attacker with a crafted wav file, could cause an application to crash. (CVE-2021-33844)

  - A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-     overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive     information. (CVE-2021-3643)

  - A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound     Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer     overflow. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-40426)

  - In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
    (CVE-2022-31650)

  - In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a. (CVE-2022-31651)

  - A floating point exception vulnerability was found in sox, in the read_samples function at     sox/src/voc.c:334:18. This flaw can lead to a denial of service. (CVE-2023-32627)

  - A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41.
    This flaw can lead to a denial of service, code execution, or information disclosure. (CVE-2023-34318)

  - A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at     sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information     disclosure. (CVE-2023-34432)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5904-1 advisory.

    Helmut Grohne discovered that SoX incorrectly handled certain inputs. If a user or an automated system     were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue     to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu     18.04 LTS. (CVE-2019-13590)

    Helmut Grohne discovered that SoX incorrectly handled certain inputs. If a user or an automated system     were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue     to cause a denial of service. (CVE-2021-23159, CVE-2021-23172, CVE-2021-23210, CVE-2021-33844,     CVE-2021-3643, CVE-2021-40426, CVE-2022-31650, and CVE-2022-31651)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3315 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3315-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Helmut Grohne     February 10, 2023                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : sox     Version        : 14.4.2+git20190427-1+deb10u1     CVE ID         : CVE-2019-13590 CVE-2021-3643 CVE-2021-23159 CVE-2021-23172                      CVE-2021-23210 CVE-2021-33844 CVE-2021-40426 CVE-2022-31650                      CVE-2022-31651     Debian Bug     : 933372 1010374 1012138 1012516 1021133 1021134 1021135

    This update fixes multiple file format validation vulnerabilities that could     result in memory access violations such as buffer overflows and floating point     exceptions. It also fixes a regression in hcom parsing introduced when fixing     CVE-2017-11358.

    CVE-2019-13590

        In sox-fmt.h (startread function), there is an integer overflow on the         result of integer addition (wraparound to 0) fed into the lsx_calloc macro         that wraps malloc. When a NULL pointer is returned, it is used without a         prior check that it is a valid pointer, leading to a NULL pointer         dereference on lsx_readbuf in formats_i.c.

    CVE-2021-3643

        The lsx_adpcm_init function within libsox leads to a         global-buffer-overflow. This flaw allows an attacker to input a malicious         file, leading to the disclosure of sensitive information.

    CVE-2021-23159

        A vulnerability was found in SoX, where a heap-buffer-overflow occurs         in function lsx_read_w_buf() in formats_i.c file. The vulnerability is         exploitable with a crafted file, that could cause an application to         crash.

    CVE-2021-23172

        A vulnerability was found in SoX, where a heap-buffer-overflow occurs         in function startread() in hcom.c file. The vulnerability is         exploitable with a crafted hcomn file, that could cause an application         to crash.

    CVE-2021-23210

        A floating point exception (divide-by-zero) issue was discovered in         SoX in functon read_samples() of voc.c file. An attacker with a         crafted file, could cause an application to crash.

    CVE-2021-33844

        A floating point exception (divide-by-zero) issue was discovered in         SoX in functon startread() of wav.c file. An attacker with a crafted         wav file, could cause an application to crash.

    CVE-2021-40426

        A heap-based buffer overflow vulnerability exists in the sphere.c         start_read() functionality of Sound Exchange libsox. A specially-crafted         file can lead to a heap buffer overflow. An attacker can provide a         malicious file to trigger this vulnerability.

    CVE-2022-31650

        There is a floating-point exception in lsx_aiffstartwrite in aiff.c.

    CVE-2022-31651

        There is an assertion failure in rate_init in rate.c.

    For Debian 10 buster, these problems have been fixed in version     14.4.2+git20190427-1+deb10u1.

    We recommend that you upgrade your sox packages.

    For the detailed security status of sox please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/sox

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in libsox.a in SoX 14.4.2. In     sox-fmt.h (startread function), there is an integer     overflow on the result of integer addition (wraparound     to 0) fed into the lsx_calloc macro that wraps malloc.
    When a NULL pointer is returned, it is used without a     prior check that it is a valid pointer, leading to a     NULL pointer dereference on lsx_readbuf in     formats_i.c.(CVE-2019-13590)

  - An issue was discovered in SoX 14.4.2. In xmalloc.h,     there is an integer overflow on the result of     multiplication fed into the lsx_valloc macro that wraps     malloc. When the buffer is allocated, it is smaller     than expected, leading to a heap-based buffer overflow     in channels_start in remix.c.(CVE-2019-8355)

  - An issue was discovered in SoX 14.4.2. lsx_make_lpf in     effect_i_dsp.c allows a NULL pointer     dereference.(CVE-2019-8357)

  - An issue was discovered in SoX 14.4.2. One of the     arguments to bitrv2 in fft4g.c is not guarded, such     that it can lead to write access outside of the     statically declared array, aka a stack-based buffer     overflow.(CVE-2019-8356)

  - In lsx_aiffstartread in aiff.c in Sound eXchange (SoX)     14.4.2, there is a Use-After-Free vulnerability     triggered by supplying a malformed AIFF     file.(CVE-2017-15642)

  - The read_samples function in hcom.c in Sound eXchange     (SoX) 14.4.2 allows remote attackers to cause a denial     of service (invalid memory read and application crash)     via a crafted hcom file.(CVE-2017-11358)

  - The startread function in wav.c in Sound eXchange (SoX)     14.4.2 allows remote attackers to cause a denial of     service (divide-by-zero error and application crash)     via a crafted wav file.(CVE-2017-11332)

  - The wavwritehdr function in wav.c in Sound eXchange     (SoX) 14.4.2 allows remote attackers to cause a denial     of service (divide-by-zero error and application crash)     via a crafted snd file, during conversion to a wav     file.(CVE-2017-11359)

  - There is a heap-based buffer overflow in the ImaExpandS     function of ima_rw.c in Sound eXchange (SoX) 14.4.2. A     Crafted input will lead to a denial of service attack     during conversion of an audio file.(CVE-2017-15370)

  - There is a reachable assertion abort in the function     sox_append_comment() in formats.c in Sound eXchange     (SoX) 14.4.2. A Crafted input will lead to a denial of     service attack during conversion of an audio     file.(CVE-2017-15371)

  - There is a stack-based buffer overflow in the     lsx_ms_adpcm_block_expand_i function of adpcm.c in     Sound eXchange (SoX) 14.4.2. A Crafted input will lead     to a denial of service attack during conversion of an     audio file.(CVE-2017-15372)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in SoX 14.4.2. In xmalloc.h,     there is an integer overflow on the result of     multiplication fed into the lsx_valloc macro that wraps     malloc. When the buffer is allocated, it is smaller     than expected, leading to a heap-based buffer overflow     in channels_start in remix.c.(CVE-2019-8355)

  - An issue was discovered in SoX 14.4.2. One of the     arguments to bitrv2 in fft4g.c is not guarded, such     that it can lead to write access outside of the     statically declared array, aka a stack-based buffer     overflow.(CVE-2019-8356)

  - An issue was discovered in SoX 14.4.2. lsx_make_lpf in     effect_i_dsp.c allows a NULL pointer     dereference.(CVE-2019-8357)

  - An issue was discovered in libsox.a in SoX 14.4.2. In     sox-fmt.h (startread function), there is an integer     overflow on the result of integer addition (wraparound     to 0) fed into the lsx_calloc macro that wraps malloc.
    When a NULL pointer is returned, it is used without a     prior check that it is a valid pointer, leading to a     NULL pointer dereference on lsx_readbuf in     formats_i.c.(CVE-2019-13590)

  - The startread function in wav.c in Sound eXchange (SoX)     14.4.2 allows remote attackers to cause a denial of     service (divide-by-zero error and application crash)     via a crafted wav file.(CVE-2017-11332)

  - The read_samples function in hcom.c in Sound eXchange     (SoX) 14.4.2 allows remote attackers to cause a denial     of service (invalid memory read and application crash)     via a crafted hcom file.(CVE-2017-11358)

  - The wavwritehdr function in wav.c in Sound eXchange     (SoX) 14.4.2 allows remote attackers to cause a denial     of service (divide-by-zero error and application crash)     via a crafted snd file, during conversion to a wav     file.(CVE-2017-11359)

  - There is a heap-based buffer overflow in the ImaExpandS     function of ima_rw.c in Sound eXchange (SoX) 14.4.2. A     Crafted input will lead to a denial of service attack     during conversion of an audio file.(CVE-2017-15370)

  - There is a reachable assertion abort in the function     sox_append_comment() in formats.c in Sound eXchange     (SoX) 14.4.2. A Crafted input will lead to a denial of     service attack during conversion of an audio     file.(CVE-2017-15371)

  - There is a stack-based buffer overflow in the     lsx_ms_adpcm_block_expand_i function of adpcm.c in     Sound eXchange (SoX) 14.4.2. A Crafted input will lead     to a denial of service attack during conversion of an     audio file.(CVE-2017-15372)

  - In lsx_aiffstartread in aiff.c in Sound eXchange (SoX)     14.4.2, there is a Use-After-Free vulnerability     triggered by supplying a malformed AIFF     file.(CVE-2017-15642)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in SoX 14.4.2. In xmalloc.h,     there is an integer overflow on the result of     multiplication fed into the lsx_valloc macro that wraps     malloc. When the buffer is allocated, it is smaller     than expected, leading to a heap-based buffer overflow     in channels_start in remix.c.(CVE-2019-8355)

  - An issue was discovered in SoX 14.4.2. One of the     arguments to bitrv2 in fft4g.c is not guarded, such     that it can lead to write access outside of the     statically declared array, aka a stack-based buffer     overflow.(CVE-2019-8356)

  - An issue was discovered in SoX 14.4.2. lsx_make_lpf in     effect_i_dsp.c allows a NULL pointer     dereference.(CVE-2019-8357)

  - An issue was discovered in libsox.a in SoX 14.4.2. In     sox-fmt.h (startread function), there is an integer     overflow on the result of integer addition (wraparound     to 0) fed into the lsx_calloc macro that wraps malloc.
    When a NULL pointer is returned, it is used without a     prior check that it is a valid pointer, leading to a     NULL pointer dereference on lsx_readbuf in     formats_i.c.(CVE-2019-13590)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183956	openSUSE 15 Security Update : sox (openSUSE-SU-2023:0329-1)	Nessus	SuSE Local Security Checks	critical
183954	openSUSE 15 Security Update : sox (openSUSE-SU-2023:0328-1)	Nessus	SuSE Local Security Checks	critical
172049	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : SoX vulnerabilities (USN-5904-1)	Nessus	Ubuntu Local Security Checks	critical
171357	Debian dla-3315 : libsox-dev - security update	Nessus	Debian Local Security Checks	critical
149127	EulerOS 2.0 SP3 : sox (EulerOS-SA-2021-1850)	Nessus	Huawei Local Security Checks	medium
146720	EulerOS 2.0 SP2 : sox (EulerOS-SA-2021-1359)	Nessus	Huawei Local Security Checks	medium
144236	EulerOS 2.0 SP5 : sox (EulerOS-SA-2020-2565)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2019-13590

medium

Tenable Plugins

critical

critical

critical

critical

medium

medium

medium