CVE-2017-6831 Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and 0.2.7 allows remote attackers to cause a...
MediumCVSS 5.5
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/audiofile(Debian:12) | < 0.3.6-4 | 0.3.6-4 |
| debian/audiofile(Debian:13) | < 0.3.6-4 | 0.3.6-4 |
| debian/audiofile(Debian:14) | < 0.3.6-4 | 0.3.6-4 |
| audiofile | = 0.2.7 | No fix listed |
| audiofile | = 0.3.0 | No fix listed |
| audiofile | = 0.3.1 | No fix listed |
| audiofile | = 0.3.2 | No fix listed |
| audiofile | = 0.3.3 | No fix listed |
| audiofile | = 0.3.4 | No fix listed |
| audiofile | = 0.3.5 | No fix listed |
| audiofile | = 0.3.6 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-6831 vendor-advisory
- DSA-3814 third-party-advisory vendor-advisory
- [oss-security] 20170313 Re: audiofile: heap-based buffer overflow in IMA::decodeBlockWAVE (IMA.cpp) mailing-list third-party-advisory
- 97588 third-party-advisory vdb-entry
- blogs.gentoo.org third-party-advisory vdb-entry
- github.com exploit third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- bugs.debian.org issue-tracking