Input validation error in SoX - CVE-2022-31650

Vulnerability identifier: #VU63803

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31650

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a floating point exception in lsx_aiffstartwrite in aiff.c in libsox.a. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

SoX
Debian Linux
Ubuntu
libsox2 (Ubuntu package)
sox (Ubuntu package)
libsox3 (Ubuntu package)
sox (Debian package)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

libsox2 (Ubuntu package) - update to Ubuntu Pro
sox (Ubuntu package) - addressed in versions Ubuntu Pro, 14.4.2+git20190427-3ubuntu0.1, 14.4.2+git20190427-3ubuntu0.2, 14.4.2+git20190427-2+deb11u1build0.20.04.1, 14.4.2+git20190427-2+deb11u1build0.22.04.1, 14.4.2+git20190427-2+deb11u2build0.20.04.1, 14.4.2+git20190427-2+deb11u2build0.22.04.1, 14.4.2-3ubuntu0.18.04.2, 14.4.2-3ubuntu0.18.04.3
libsox3 (Ubuntu package) - addressed in versions 14.4.2+git20190427-3ubuntu0.1, 14.4.2+git20190427-3ubuntu0.2, 14.4.2+git20190427-2+deb11u1build0.20.04.1, 14.4.2+git20190427-2+deb11u1build0.22.04.1, 14.4.2+git20190427-2+deb11u2build0.20.04.1, 14.4.2+git20190427-2+deb11u2build0.22.04.1, 14.4.2-3ubuntu0.18.04.2, 14.4.2-3ubuntu0.18.04.3
sox (Debian package) - update to 14.4.2+git20190427-2+deb11u1

• https://sourceforge.net/p/sox/bugs/360/

• Multiple vulnerabilities in SoX
• Ubuntu update for sox
• Ubuntu update for sox
• Debian update for sox