OESA-2026-4707: audiofile security update
The Audio File Library is a C-based library for reading and writing audio files in many common formats. Security Fix(es):
Heap-based buffer overflow in the alaw2linearbuf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.(CVE-2017-6830)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/audiofileto a version that resolves this vulnerability.Fixed in 0.3.6-33.oe2203sp4
Event History
Frequently Asked Questions
What must an attacker do to trigger the flaw?
An attacker must provide a crafted audio file that is processed by the affected Audio File Library. The issue is in the alaw2linear_buf function in G711.cpp.
What is the likely impact if exploitation succeeds?
Successful exploitation can cause a heap-based buffer overflow resulting in a denial of service through a crash. The provided data does not indicate confidentiality or integrity impact.
Is user interaction required?
Yes. The supplied CVSS vector includes UI:R, indicating that user interaction is required. The vector also indicates local attack vector and no privileges required.