CVE-2017-15642: Use After Free
Published Oct 19, 2017
·Updated
In lsxaiffstartread in aiff.c in Sound eXchange (SoX) 14.4.2, there is a Use-After-Free vulnerability triggered by supplying a malformed AIFF file.
Affected Software
3 affected components
Sound Exchange Project Sound Exchange=14.4.2
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Event History
Oct 19, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-15642?
CVE-2017-15642 has a medium severity rating due to the potential for exploitation via specially crafted AIFF files.
2
How do I fix CVE-2017-15642?
To fix CVE-2017-15642, update to Sound eXchange version 14.4.3 or later where the vulnerability is patched.
3
What types of systems are affected by CVE-2017-15642?
CVE-2017-15642 affects Sound eXchange version 14.4.2 and Debian GNU/Linux versions 7.0 and 8.0.
4
Can CVE-2017-15642 be exploited remotely?
Yes, CVE-2017-15642 can be exploited remotely if an attacker convinces a user to process a malicious AIFF file.
5
What is a Use-After-Free vulnerability as seen in CVE-2017-15642?
A Use-After-Free vulnerability occurs when a program continues to use a memory resource after it has been freed, potentially allowing arbitrary code execution.