Out-of-bounds read in libsndfile - CVE-2018-19662

Vulnerability identifier: #VU16177

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19662

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service. A remote attacker can perform a denial of service attack.

libsndfile
libsndfile (Ubuntu package)
libsndfile (Red Hat package)
libsndfile (Alpine package)
libsndfile1 (Ubuntu package)
sndfile-programs (Ubuntu package)
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Ubuntu

Install update from vendor's website.

libsndfile (Ubuntu package) - addressed in versions 1.0.25-10ubuntu0.16.04.2, 1.0.28-4ubuntu0.18.04.1, 1.0.28-4ubuntu0.18.10.1
libsndfile (Red Hat package) - addressed in versions 1.0.25-12.el7, 1.0.28-10.el8
libsndfile (Alpine package) - update to 1.0.28-r4
libsndfile1 (Ubuntu package) - addressed in versions 1.0.25-10ubuntu0.16.04.3, 1.0.2510ubuntu0.16.04.3+esm2
sndfile-programs (Ubuntu package) - addressed in versions 1.0.25-10ubuntu0.16.04.3, 1.0.2510ubuntu0.16.04.3+esm2

• https://github.com/erikd/libsndfile/issues/429

• Denial of service in libsndfile
• Ubuntu update for libsndfile
• Red Hat Enterprise Linux 8 update for libsndfile
• Out-of-bounds read in libsndfile (Alpine package)
• Red Hat Enterprise Linux 7 update for libsndfile
• Ubuntu update for libsndfile