OESA-2026-4705: audiofile security update
The Audio File Library is a C-based library for reading and writing audio files in many common formats. Security Fix(es):
Heap-based buffer overflow in the alaw2linearbuf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.(CVE-2017-6830)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/audiofileto a version that resolves this vulnerability.Fixed in 0.3.6-33.oe2403sp1
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must provide a crafted audio file that is processed by the affected Audio File Library. Exploitation requires user interaction, such as opening or otherwise processing the malicious file.
What is the likely impact of successful exploitation?
Successful exploitation can cause a heap-based buffer overflow that crashes the application processing the crafted file. The reported impact is denial of service; no confidentiality or integrity impact is specified.
Are systems exposed over the network by default?
The reported attack vector is local, not network-based. Exposure depends on whether software on the system uses the affected library to process attacker-controlled audio files.