CVE-2024-23709: Out of Bounds Read in WT_VoiceGain in eas_wtengine.c
Summary
CVE-2024-23709: In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/external/sonivox across 5 version ranges.
>= 12:0, < 12:2024-05-01
>= 12L:0, < 12L:2024-05-01
>= 13:0, < 13:2024-05-01
>= 14:0, < 14:2024-05-01
>= 14-next:0, < 14-next:2024-05-01
Fixed in 14-next:2024-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is 'platform/external/sonivox' in the Android ecosystem. Sonivox is a software synthesizer that provides virtual instruments for music production. It is used in various Android versions, starting from 12 to 14. The vulnerability affects the WT_VoiceGain function in the eas_wtengine.c file.
Vulnerability Detail
The vulnerability is an out-of-bounds read issue that occurs due to a heap buffer overflow. It can be exploited remotely to disclose sensitive information without requiring additional execution privileges. Exploitation of this vulnerability requires user interaction. The issue has been assigned the CVE identifier CVE-2024-23709.
How To Fix
Minimum fixed version
14-next:2024-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the 'platform/external/sonivox' package in the Android ecosystem is vulnerable to an out-of-bounds read issue in the WT_VoiceGain function. This vulnerability can lead to remote information disclosure. It is crucial to update the package to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/external/sonivox →
FAQ
The vulnerability can lead to remote information disclosure, potentially exposing sensitive data.
Yes, user interaction is needed for the vulnerability to be exploited.
The vulnerability affects Android versions 12, 12L, 13, and 14.
The recommended mitigation is to update the affected package to the fixed version.
No evidence of active exploitation has been reported at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/sonivox.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
