Vulnerability CVE-2019-8356: Information

Description

An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.

Severity: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-8356
Published: Feb. 16, 2019
Modified: Aug. 24, 2020
Error type identifier: CWE-787, CWE-129

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
soxsisyphus14.4.2-alt714.4.2-alt7ALT-PU-2024-6289-3344866Fixed
soxsisyphus_e2k14.4.2-alt714.4.2-alt7ALT-PU-2024-6551-1-Fixed
soxsisyphus_riscv6414.4.2-alt714.4.2-alt7ALT-PU-2024-6403-1-Fixed
soxsisyphus_loongarch6414.4.2-alt714.4.2-alt7ALT-PU-2024-6418-1-Fixed
soxp1014.4.2-alt714.4.2-alt7ALT-PU-2024-6378-3344935Fixed
soxp10_e2k14.4.2-alt714.4.2-alt7ALT-PU-2024-6891-1-Fixed
soxc10f114.4.2-alt714.4.2-alt7ALT-PU-2024-6855-3345456Fixed
soxc9f214.4.2-alt714.4.2-alt7ALT-PU-2024-6966-3345644Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://sourceforge.net/p/sox/bugs/321
  • Exploit
  • Third Party Advisory
[debian-lts-announce] 20190528 [SECURITY] [DLA 1808-1] sox security update
    USN-4079-1
      USN-4079-2

          1. Configuration 1

            cpe:2.3:a:sound_exchange_project:sound_exchange:14.4.2:*:*:*:*:*:*:*
        VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
        Version: v24.5.1
        Back to top