Division by zero in SoX - CVE-2021-33844

Vulnerability identifier: #VU73930

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33844

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a divide by zero error within the startread() function in wav.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.

SoX
Debian Linux
Ubuntu
libsox2 (Ubuntu package)
sox (Ubuntu package)
libsox3 (Ubuntu package)
sox (Debian package)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

libsox2 (Ubuntu package) - update to Ubuntu Pro
sox (Ubuntu package) - addressed in versions Ubuntu Pro, 14.4.2+git20190427-3ubuntu0.1, 14.4.2+git20190427-3ubuntu0.2, 14.4.2+git20190427-2+deb11u1build0.20.04.1, 14.4.2+git20190427-2+deb11u1build0.22.04.1, 14.4.2+git20190427-2+deb11u2build0.20.04.1, 14.4.2+git20190427-2+deb11u2build0.22.04.1, 14.4.2-3ubuntu0.18.04.2, 14.4.2-3ubuntu0.18.04.3
libsox3 (Ubuntu package) - addressed in versions 14.4.2+git20190427-3ubuntu0.1, 14.4.2+git20190427-3ubuntu0.2, 14.4.2+git20190427-2+deb11u1build0.20.04.1, 14.4.2+git20190427-2+deb11u1build0.22.04.1, 14.4.2+git20190427-2+deb11u2build0.20.04.1, 14.4.2+git20190427-2+deb11u2build0.22.04.1, 14.4.2-3ubuntu0.18.04.2, 14.4.2-3ubuntu0.18.04.3
sox (Debian package) - update to 14.4.2+git20190427-2+deb11u1

• https://bugzilla.redhat.com/show_bug.cgi?id=1975664
• https://security.archlinux.org/CVE-2021-33844
• https://access.redhat.com/security/cve/CVE-2021-33844
• https://sourceforge.net/p/sox/bugs/349/

• Multiple vulnerabilities in SoX
• Ubuntu update for sox
• Ubuntu update for sox
• Debian update for sox