Debian 8: DLA-1705-1 Moderate: SoX Denial Of Service vulnerabilities

debian lts

March 5, 2019

Multiple vulnerabilities have been discovered in SoX (Sound eXchange), a sound processing program: CVE-2017-11332

Topics Covered

security advisory denial of service debian sox application crash sound processing

Summary

The startread function (wav.c) is affected by a divide-by-zero
vulnerability when processing WAV file with zero channel count. This
flaw might be leveraged by remote attackers using a crafted WAV file
to perform denial of service (application crash).

CVE-2017-11358

The read_samples function (hcom.c) is affected by an invalid memory read
vulnerability when processing HCOM files with invalid dictionnaries. This
flaw might be leveraged by remote attackers using a crafted HCOM file to
perform denial of service (application crash).

CVE-2017-11359

The wavwritehdr function (wav.c) is affected by a divide-by-zero
vulnerability when processing WAV files with invalid channel count over
16 bits. This flaw might be leveraged by remote attackers using a crafted
WAV file to perform denial of service (application crash).

CVE-2017-15371

The sox_append_comment() function (formats.c) is vulnerable to a reachable