Summary
It was discovered that libsndfile incorrectly handled memory when executing
its FLAC codec. If a user or automated system were tricked into processing
a specially crafted sound file, an attacker could possibly use this issue
to cause a denial of service or obtain sensitive information.
(CVE-2021-4156)
It was discovered that libsndfile incorrectly handled certain malformed
OggVorbis files. An attacker could possibly use this issue to cause
libsndfile to crash, resulting in a denial of service. (CVE-2024-50612)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libsndfile | 1.0.28-7ubuntu0.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | libsndfile | 1.0.31-2ubuntu0.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libsndfile | 1.0.25-7ubuntu2.2+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libsndfile | 1.0.28-4ubuntu0.18.04.2+esm2 |
Vulnerabilities 2
-
Medium 5.3
libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.
-
Unscored —
An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a spec…