libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7273-1 advisory.

    It was discovered that libsndfile incorrectly handled memory when executing its FLAC codec. If a user or     automated system were tricked into processing a specially crafted sound file, an attacker could possibly     use this issue to cause a denial of service or obtain sensitive information. (CVE-2021-4156)

    It was discovered that libsndfile incorrectly handled certain malformed OggVorbis files. An attacker could     possibly use this issue to cause libsndfile to crash, resulting in a denial of service. (CVE-2024-50612)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7267-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed OggVorbis files. An attacker could     possibly use this issue to cause libsndfile to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:11237 advisory.

    * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-11237 advisory.

    [1.0.31-8.2]
    - fix crash in ogg vorbis (#RHEL-65096) (CVE-2024-50612)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:11192 advisory.

    * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11172 advisory.

    libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or     WAV.

    Security Fix(es):

    * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11237 advisory.

    libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or     WAV.

    Security Fix(es):

    * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11192 advisory.

    libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or     WAV.

    Security Fix(es):

    * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-11192 advisory.

    [1.0.28-16]
    - fix prerequisit patch (#RHEL-65093)

    [1.0.28-15]
    - fix crash in ogg vorbis (#RHEL-65093) (CVE-2024-50612)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3ae3a47901 advisory.

    - fix crash in in ogg vorbis (rhbz#2322326) (CVE-2024-50612)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-1318318e7a advisory.

    fix crash in in ogg vorbis (#2322326) (CVE-2024-50612)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216423	Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : libsndfile vulnerabilities (USN-7273-1)	Nessus	Ubuntu Local Security Checks	high
216330	Ubuntu 16.04 LTS : libsndfile vulnerability (USN-7267-1)	Nessus	Ubuntu Local Security Checks	medium
213338	AlmaLinux 9 : libsndfile:1.0.31 (ALSA-2024:11237)	Nessus	Alma Linux Local Security Checks	medium
213263	Oracle Linux 9 : libsndfile:1.0.31 (ELSA-2024-11237)	Nessus	Oracle Linux Local Security Checks	medium
213181	AlmaLinux 8 : libsndfile (ALSA-2024:11192)	Nessus	Alma Linux Local Security Checks	medium
213163	RHEL 9 : libsndfile (RHSA-2024:11172)	Nessus	Red Hat Local Security Checks	medium
213161	RHEL 9 : libsndfile:1.0.31 (RHSA-2024:11237)	Nessus	Red Hat Local Security Checks	medium
213158	RHEL 8 : libsndfile (RHSA-2024:11192)	Nessus	Red Hat Local Security Checks	medium
213134	Oracle Linux 8 : libsndfile (ELSA-2024-11192)	Nessus	Oracle Linux Local Security Checks	medium
211892	Fedora 40 : libsndfile (2024-3ae3a47901)	Nessus	Fedora Local Security Checks	medium
211715	Fedora 41 : libsndfile (2024-1318318e7a)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2024-50612

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium