Denial of Service Vulnerability in libsndfile: Buffer Over-read Risk
Summary
ALPINE-CVE-2017-8365: The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file. Affects libsndfile versions < 1.0.28-r1. Fixed in 1.0.28-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsndfile is a widely used library for reading and writing audio files in various formats. It provides a simple API for developers to manipulate audio data, making it essential for applications that handle sound processing. However, libsndfile version 1.0.28 has a vulnerability that can lead to a denial of service, impacting applications that rely on this library.
Vulnerability Detail
The vulnerability, identified as CVE-2017-8365, is rooted in the i2les_array function within the pcm.c file of libsndfile version 1.0.28. This flaw allows remote attackers to exploit crafted audio files, resulting in a buffer over-read and potentially causing the application to crash. The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk that could disrupt service availability.
How To Fix
Minimum fixed version
1.0.28-r1
This is the first release that contains the fix.
sudo apk add --upgrade libsndfileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to check audio files before processing them, thereby mitigating the risk of exploitation.
Conclusion
The vulnerability in libsndfile poses a significant risk to applications that process audio files. By updating to the patched version and implementing recommended workarounds, developers can safeguard their applications against potential attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for libsndfile →
FAQ
CVE-2017-8365 is a vulnerability in libsndfile that allows remote attackers to cause a denial of service through crafted audio files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to application crashes, resulting in service disruptions and potential data loss.
Yes, the patched version of libsndfile is 1.0.28-r1. Updating to this version will resolve the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json, helping you maintain security.
References
Related vulnerabilities
Recent vulnerabilities recorded for libsndfile.
