Skip to content
OpenAdvisories
Medium ALAS2-2023-2231 9 CVEs

Moderate: sox security update (Amazon Linux 2)

Published Aug 31, 2023 · Updated Sep 26, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34432: A vulnerabilty was found in sox v14.4.3, heap-buffer-overflow vulnerability that exists in the lsx_readbuf function at sox/src/formats_i.c:98:16. This vulnerability could lead to security issues such as denial of service, code execution, or information disclosure. CVE-2023-34318: A vulnerabilty was found in sox v14.4.3, heap-buffer-overflow vulnerability that exists in the startread function at sox/src/hcom.c:160:41. This vulnerability could lead to security issues such as denial of service, code execution, or information disclosure CVE-2023-32627: A vulnerabilty was found in sox v14.4.3, where floating point exception vulnerability that exists in the read_samples function at sox/src/voc.c:334:18. This vulnerability could lead to security issues such as denial of service. CVE-2023-26590: A vulnerabilty was found in sox v14.4.3, Floating Point Exception vulnerability that exists in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58. This vulnerability could lead to security issues such as denial of service. CVE-2022-31651: In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a. CVE-2022-31650: In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a. CVE-2021-3643: A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information. CVE-2021-23172: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash. CVE-2021-23159: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to crash.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 sox 0:14.4.1-7.amzn2.0.2
Amazon Linux · 2 sox-debuginfo 0:14.4.1-7.amzn2.0.2
Amazon Linux · 2 sox-devel 0:14.4.1-7.amzn2.0.2

Vulnerabilities 9

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23159.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-23172.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-3643.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31650.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31651.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26590.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-32627.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-34318.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-34432.html