NULL pointer dereference in libsndfile - CVE-2018-19432
Published: November 22, 2018 / Updated: August 17, 2023
Vulnerability identifier: #VU16040
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19432
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to NULL pointer dereference in the function sf_write_int in sndfile.c. A remote attacker can trigger NULL pointer dereference and cause the service to crash.
Affected software
libsndfile
libsndfile (Ubuntu package)
SUSE Linux Enterprise Module for Packagehub Subpackages
libsndfile1 (Ubuntu package)
sndfile-programs (Ubuntu package)
libsndfile-debugsource
libsndfile-devel
libsndfile1
libsndfile1-debuginfo
libsndfile1-32bit
libsndfile1-32bit-debuginfo
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
libsndfile (Ubuntu package)
SUSE Linux Enterprise Module for Packagehub Subpackages
libsndfile1 (Ubuntu package)
sndfile-programs (Ubuntu package)
libsndfile-debugsource
libsndfile-devel
libsndfile1
libsndfile1-debuginfo
libsndfile1-32bit
libsndfile1-32bit-debuginfo
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
How to mitigate CVE-2018-19432
Install update from vendor's website.
libsndfile (Ubuntu package) - addressed in versions 1.0.25-10ubuntu0.16.04.2, 1.0.28-4ubuntu0.18.04.1, 1.0.28-4ubuntu0.18.10.1
libsndfile1 (Ubuntu package) - addressed in versions 1.0.25-10ubuntu0.16.04.3, 1.0.2510ubuntu0.16.04.3+esm2
sndfile-programs (Ubuntu package) - addressed in versions 1.0.25-10ubuntu0.16.04.3, 1.0.2510ubuntu0.16.04.3+esm2
libsndfile-debugsource - update to 1.0.28-5.12.1
libsndfile-devel - update to 1.0.28-5.12.1
libsndfile1 - update to 1.0.28-5.12.1
libsndfile1-debuginfo - update to 1.0.28-5.12.1
libsndfile1-32bit - update to 1.0.28-5.12.1
libsndfile1-32bit-debuginfo - update to 1.0.28-5.12.1
libsndfile1 (Ubuntu package) - addressed in versions 1.0.25-10ubuntu0.16.04.3, 1.0.2510ubuntu0.16.04.3+esm2
sndfile-programs (Ubuntu package) - addressed in versions 1.0.25-10ubuntu0.16.04.3, 1.0.2510ubuntu0.16.04.3+esm2
libsndfile-debugsource - update to 1.0.28-5.12.1
libsndfile-devel - update to 1.0.28-5.12.1
libsndfile1 - update to 1.0.28-5.12.1
libsndfile1-debuginfo - update to 1.0.28-5.12.1
libsndfile1-32bit - update to 1.0.28-5.12.1
libsndfile1-32bit-debuginfo - update to 1.0.28-5.12.1