Published: 27/07/2011 Updated: 13/02/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Integer overflow in libsndfile prior to 1.0.25 allows remote malicious users to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PARIS Audio Format (PAF) file that triggers a heap-based buffer overflow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mega-nerd libsndfile 1.0.18
mega-nerd libsndfile 1.0.0
mega-nerd libsndfile 1.0.3
mega-nerd libsndfile 1.0.13
mega-nerd libsndfile 1.0.19
mega-nerd libsndfile 1.0.15
mega-nerd libsndfile 1.0.6
mega-nerd libsndfile 0.0.8
mega-nerd libsndfile 1.0.10
mega-nerd libsndfile 0.0.28
mega-nerd libsndfile 1.0.21
mega-nerd libsndfile 1.0.7
mega-nerd libsndfile 1.0.9
mega-nerd libsndfile 1.0.22
mega-nerd libsndfile 1.0.17
mega-nerd libsndfile 1.0.20
mega-nerd libsndfile
mega-nerd libsndfile 1.0.5
mega-nerd libsndfile 1.0.4
mega-nerd libsndfile 1.0.14
mega-nerd libsndfile 1.0.12
mega-nerd libsndfile 1.0.11
mega-nerd libsndfile 1.0.23
mega-nerd libsndfile 1.0.1
mega-nerd libsndfile 1.0.8
mega-nerd libsndfile 1.0.16
mega-nerd libsndfile 1.0.2

An application using libsndfile could be made to crash or possibly run programs as your login if it opened a specially crafted file ...

Hossein Lotfi discovered an integer overflow in libsndfile's code to parse Paris Audio files, which could potentially lead to the execution of arbitrary code For the oldstable distribution (lenny), this problem has been fixed in version 1017-4+lenny3 For the stable distribution (squeeze), this problem has been fixed in version 1021-3+squeeze1 ...

CWE-119 http://www.openwall.com/lists/oss-security/2011/07/14/3 http://www.openwall.com/lists/oss-security/2011/07/14/2 http://secunia.com/advisories/45125 http://secunia.com/advisories/45351 http://www.mega-nerd.com/libsndfile/ChangeLog https://bugs.gentoo.org/show_bug.cgi?id=375125 http://www.openwall.com/lists/oss-security/2011/07/15/1 http://www.openwall.com/lists/oss-security/2011/07/18/1 https://bugzilla.redhat.com/show_bug.cgi?id=721234 http://www.openwall.com/lists/oss-security/2011/07/15/4 http://www.redhat.com/support/errata/RHSA-2011-1084.html http://www.securityfocus.com/bid/48644 http://www.openwall.com/lists/oss-security/2011/07/15/3 http://www.openwall.com/lists/oss-security/2011/07/14/4 http://www.openwall.com/lists/oss-security/2011/07/14/1 http://www.securelist.com/en/advisories/45125 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062955.html http://secunia.com/advisories/45433 http://www.debian.org/security/2011/dsa-2288 http://secunia.com/advisories/45384 http://secunia.com/advisories/45388 http://www.ubuntu.com/usn/USN-1174-1 https://hermes.opensuse.org/messages/10387521 http://www.mandriva.com/security/advisories?name=MDVSA-2011:119 https://usn.ubuntu.com/1174-1/https://nvd.nist.gov

CVE-2011-2696

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect