CVE-2018-14523 Aubio is vulnerable to out of bound read when samplerate > 50kHz
HighCVSS 8.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi aubio(PyPI) | < 0.4.7 | 0.4.7 |
| pypi aubio(PyPI) | = 0.4.3 | No fix listed |
| pypi aubio(PyPI) | = 0.4.3.post1 | No fix listed |
| pypi aubio(PyPI) | = 0.4.3a1 | No fix listed |
| pypi aubio(PyPI) | = 0.4.3a2 | No fix listed |
| pypi aubio(PyPI) | = 0.4.4 | No fix listed |
| pypi aubio(PyPI) | = 0.4.5 | No fix listed |
| pypi aubio(PyPI) | = 0.4.6 | No fix listed |
| debian/aubio(Debian:12) | < 0.4.6-1 | 0.4.6-1 |
| debian/aubio(Debian:13) | < 0.4.6-1 | 0.4.6-1 |
| debian/aubio(Debian:14) | < 0.4.6-1 | 0.4.6-1 |
| aubio | = 0.4.6 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
| openSUSE leap | = 42.3 | No fix listed |
| SUSE linux enterprise | = 15.0 | No fix listed |
| ubuntu/aubio(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/aubio(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/aubio(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/aubio(Ubuntu:22.04) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit issue-tracking third-party-advisory
- github.com patch
- github.com product
- github.com
- openSUSE-SU-2019:1049 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2019:1229 vendor-advisory
- github.com vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-14523 vendor-advisory
- bugs.debian.org issue-tracking