SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsxmsadpcmblockexpandi() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wavmsadpcmfmt().
A vulnerabilty was found in sox v14.4.3, heap-buffer-overflow vulnerability that exists in the startread function at sox/src/hcom.c:160:41. This vulnerability could lead to security issues such as denial of service, code execution, or information disclosure
References: https://sourceforge.net/p/sox/bugs/368/
Rejected reason: This candidate is a duplicate of CVE-2017-11359.
A vulnerability was found in SoX, where a heap based overflow was found in formatsi.c:376, function lsxreadwbuf.
References: https://sourceforge.net/p/sox/bugs/352/
A vulnerability was found in SoX where, a heap overflow in hcom.c:161. Function startread with crafted hcomn file the vulnerability is exploitable.
References: https://sourceforge.net/p/sox/bugs/350/
A vulnerability was found in SoX where, a divide by zero in voc.c:334, functon readsamples
References: https://sourceforge.net/p/sox/bugs/351/
A vulnerability was found in SoX where a divide by zero bug in wav.c:967, functon startread. With crafted wav file, it crashes.
References: https://sourceforge.net/p/sox/bugs/349/
Multiple buffer overflows in the stwavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
A vulnerabilty was found in sox v14.4.3, heap-buffer-overflow vulnerability that exists in the lsxreadbuf function at sox/src/formatsi.c:98:16. This vulnerability could lead to security issues such as denial of service, code execution, or information disclosure.
References: https://sourceforge.net/p/sox/bugs/367/