CVE-2019-8354: Integer Overflow
Published Feb 15, 2019
·Updated
An issue was discovered in SoX 14.4.2. lsxmakelpf in effectidsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.
Affected Software
6 affected componentsFixes available
debian/sox
14.4.2+git20190427-2+deb11u214.4.2+git20190427-3.514.4.2+git20190427-5
Sound Exchange Project Sound Exchange=14.4.2
Debian Debian Linux=8.0
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.04
Event History
Feb 15, 2019
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Jan 11, 2024
Data Sourced
via Launchpad·11:32 PM
Description
Feb 23, 2026
Data Sourced
via Ubuntu·05:19 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2019-8354?
CVE-2019-8354 is a vulnerability in SoX 14.4.2 that allows for a heap-based buffer overflow due to an integer overflow in lsx_make_lpf function.
2
Who is affected by CVE-2019-8354?
Users of SoX 14.4.2 and related versions are affected by CVE-2019-8354.
3
What is the severity of CVE-2019-8354?
CVE-2019-8354 has a severity of medium (5) according to the Common Vulnerability Scoring System (CVSS).
4
How can I mitigate CVE-2019-8354?
To mitigate CVE-2019-8354, it is recommended to update SoX to version 14.4.2 or later.
5
Where can I find more information about CVE-2019-8354?
You can find more information about CVE-2019-8354 in the references provided: [link1], [link2], [link3].