OESA-2026-4706: audiofile security update
The Audio File Library is a C-based library for reading and writing audio files in many common formats. Security Fix(es):
Heap-based buffer overflow in the alaw2linearbuf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.(CVE-2017-6830)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/audiofileto a version that resolves this vulnerability.Fixed in 0.3.6-33.oe2403sp3
Event History
Frequently Asked Questions
What must an attacker do to trigger the issue?
An attacker needs to provide a crafted audio file that is processed by the affected Audio File Library. Successful exploitation can cause the application to crash.
What is the likely impact on affected systems?
The reported impact is denial of service through a heap-based buffer overflow in alaw2linear_buf in G711.cpp. The provided data does not indicate confidentiality or integrity impact.
Is user interaction required?
Yes. The supplied CVSS vector includes UI:R, indicating that user interaction is required. The same vector lists no privileges required and local attack vector access.