Out-of-bounds read in libsndfile (Alpine package)

1) Out-of-bounds read

EUVDB-ID: #VU16205

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-19758

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer overread condition in the wav_write_headerfunction, as defined in the wav.c source code file. A remote attacker can trick the victim into following a custom link or opening a crafted audio file that submits malicious input, trigger memory corruption and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libsndfile (Alpine package): 1.0.28-r0 - 1.0.28-r4

External links

http://git.alpinelinux.org/aports/commit/?id=83d74e47d53224f58b4350ae12ffbe8f508593e6
http://git.alpinelinux.org/aports/commit/?id=1245056475ad59a71c91494d1e1820f323e22911
http://git.alpinelinux.org/aports/commit/?id=afcf91b3195a7e0e88b3c570d405ddd1f4591460
http://git.alpinelinux.org/aports/commit/?id=eb0e8dee37539898fe7a4d9f95ff1353d3d69519
http://git.alpinelinux.org/aports/commit/?id=64a969f0cd8a0df31772a84d6b0d9f264c4a337e

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.