#VU17767 Stack-based buffer overflow in SoX - CVE-2019-8356
Published: February 19, 2019
Vulnerability identifier: #VU17767
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2019-8356
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
SoX
SoX
Software vendor:
sox.sourceforge.net
sox.sourceforge.net
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper protection on an argument passed to the bitrv2 function, as defined in the fft4g.c source code file of the affected software. A remote attacker can trick the victim into executing a file that submits malicious input to the targeted system with the sox command, trigger a stack-based buffer overflow condition and perform a denial of service (DoS) attack.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.