Memory leak in audiofile - CVE-2022-24599

Vulnerability identifier: #VU83032

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24599

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due memory leak within the printfileinfo() function in printinfo.c. A remote attacker can pass a specially crafted file to the application and gain access to potentially sensitive information.

audiofile
Fedora
openEuler
audiofile
audiofile-debuginfo
audiofile-debugsource
audiofile-devel
audiofile-help

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

audiofile - update to 0.3.6-32
audiofile-debuginfo - update to 0.3.6-32
audiofile-debugsource - update to 0.3.6-32
audiofile-devel - update to 0.3.6-32
audiofile-help - update to 0.3.6-32
audiofile - addressed in versions 0.3.6-36.el8, 0.3.6-36.el9, 0.3.6-36.fc37, 0.3.6-36.fc38, 0.3.6-36.fc39

• https://github.com/mpruett/audiofile/issues/60

• Memory leak in autofile
• Fedora 37 update for audiofile
• Fedora 39 update for audiofile
• Fedora EPEL 9 update for audiofile
• Fedora 38 update for audiofile
• Fedora EPEL 8 update for audiofile
• openEuler update for audiofile