The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libsndfile | Sep 20, 2017 | Apr 30, 2017 |
| Debian | — | Upgrade libsndfile | May 28, 2017 | Apr 30, 2017 |
| Freebsd | — | Upgrade linux-c6-libsndfileUpgrade libsndfileUpgrade linux-c7-libsndfile | Mar 2, 2018 | Mar 1, 2018 |
| Gentoo Linux | — | Upgrade media-libs/libsndfile. | Dec 3, 2018 | Apr 30, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libsndfile | Dec 4, 2019 | Apr 30, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libsndfile | Feb 15, 2019 | Apr 30, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libsndfile | Nov 19, 2019 | Apr 30, 2017 |
| Oracle Solaris | — | Upgrade library/libsndfile to version 1.0.28-0.175.3.20.0.4.0 on Solaris 11.3 | May 29, 2017 | Apr 30, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 29, 2017 |
| Suse | — | Upgrade libsndfile1-32bitUpgrade libsndfile-x86Upgrade libsndfile-32bitUpgrade libsndfileUpgrade libsndfile-develUpgrade libsndfile1 | May 10, 2017 | Apr 30, 2017 |
| Ubuntu | — | Upgrade libsndfile1 | Jun 1, 2017 | Apr 30, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub