CVE-2019-8355: Integer Overflow
An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsxvalloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channelsstart in remix.c.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-8355?
CVE-2019-8355 is a vulnerability in SoX (Sound Exchange) 14.4.2, which allows for a heap-based buffer overflow in remix.c due to an integer overflow in xmalloc.h.
How severe is CVE-2019-8355?
CVE-2019-8355 has a severity rating of 5.5 out of 10, classified as medium severity.
What is the affected software for CVE-2019-8355?
The affected software for CVE-2019-8355 includes SoX 14.4.2 and various Ubuntu and Debian packages.
How can I fix CVE-2019-8355?
To fix CVE-2019-8355, update SoX to version 14.4.2+ or apply the relevant security patches for the affected Ubuntu and Debian packages.
Where can I find more information about CVE-2019-8355?
You can find more information about CVE-2019-8355 in the Debian LTS announcement, the SoX bug tracker, and the Ubuntu Security Notice.