CVE-2019-8354

An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.

Published: Feb 16, 2019
Updated: Apr 13, 2023
CVE: CVE-2019-8354
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

CWE-787
CWE-190

Affected Software
References

Software	From	Fixed in
sound_exchange_project / sound_exchange	14.4.2	14.4.2.x
debian / debian_linux	8.0	8.0.x
canonical / ubuntu_linux	19.04	19.04.x
canonical / ubuntu_linux	16.04	16.04.x
canonical / ubuntu_linux	18.04	18.04.x

https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html
https://sourceforge.net/p/sox/bugs/319
https://usn.ubuntu.com/4079-1/
https://usn.ubuntu.com/4079-2/

Vulnerability Database

CVE-2019-8354

Deep Security Visibility Without the Complexity