Heap-based buffer overflow in audiofile - CVE-2018-17095

Vulnerability identifier: #VU15679

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-17095

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists in the ModuleState::setup function due to a heap-based buffer overflow condition that occurs when running sfconvert. A remote attacker can trick the victim into opening or executing a specially crafted file that submits malicious input, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

audiofile
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Opensuse
openEuler
Fedora
audiofile (Red Hat package)
audiofile
audiofile-debuginfo
audiofile-debugsource
audiofile-devel
audiofile-help

Update to version 0.3.6-2.

audiofile - update to 0.3.6-2
audiofile (Red Hat package) - update to 0.3.6-9.el7
audiofile - addressed in versions 0.3.6-21.fc27, 0.3.6-21.fc28, 0.3.6-21.fc29
audiofile - update to 0.3.6-32
audiofile-debuginfo - update to 0.3.6-32
audiofile-debugsource - update to 0.3.6-32
audiofile-devel - update to 0.3.6-32
audiofile-help - update to 0.3.6-32

• https://github.com/mpruett/audiofile/issues/50

• Multiple vulnerabilities in audiofile
• OpenSUSE Linux update for audiofile
• OpenSUSE Linux update for audiofile
• Red Hat Enterprise Linux 7 update for audiofile
• Fedora 29 update for audiofile
• Fedora 28 update for audiofile
• Fedora 27 update for audiofile
• openEuler update for audiofile