CVE-2019-8356: Buffer Overflow
First published: Fri Feb 15 2019(Updated: )
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sound Exchange Project Sound Exchange | =14.4.2 | |
| debian/sox | 14.4.2+git20190427-2+deb11u2 14.4.2+git20190427-3.5 14.4.2+git20190427-5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html
- https://sourceforge.net/p/sox/bugs/321
- https://usn.ubuntu.com/4079-1/
- https://usn.ubuntu.com/4079-2/
- https://launchpad.net/bugs/cve/CVE-2019-8356
- https://sourceforge.net/p/sox/code/ci/b7883ae1398499daaa926ae6621f088f0f531ed8/
- https://security-tracker.debian.org/tracker/CVE-2019-8356
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8356
- https://nvd.nist.gov/vuln/detail/CVE-2019-8356
- https://ubuntu.com/security/CVE-2019-8356
Frequently Asked Questions
What is CVE-2019-8356?
CVE-2019-8356 is a vulnerability in SoX 14.4.2 that can lead to a stack-based buffer overflow.
How severe is CVE-2019-8356?
CVE-2019-8356 has a severity rating of 5.5, which is considered medium.
What is the affected software?
The affected software is SoX 14.4.2 and potentially other versions.
How can I fix CVE-2019-8356?
To fix CVE-2019-8356, update SoX to version 14.4.2 or higher.
Where can I find more information on CVE-2019-8356?
More information on CVE-2019-8356 can be found at the following links: [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8356), [SourceForge](https://sourceforge.net/p/sox/bugs/321), [Ubuntu Security Notice](https://ubuntu.com/security/notices/USN-4079-1).
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/description
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- collector/usn-cve
- source/Ubuntu
- vendor/sound exchange project
- canonical/sound exchange project sound exchange
- version/sound exchange project sound exchange/14.4.2
- package-manager/debian