Medium severity · published Feb 15, 2019
CVE-2019-8356
An issue was discovered in SoX 14.4.2
5.5
CVSS
1.8%
EPSS
No
On KEV
Description
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Sound Exchange · Sound Exchange Project
14.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-8356
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-8356
lists.debian.org
https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html
Exploit
https://sourceforge.net/p/sox/bugs/321
usn.ubuntu.com
https://usn.ubuntu.com/4079-1/
usn.ubuntu.com
https://usn.ubuntu.com/4079-2/
More from Sound Exchange
9.1
CVE-2021-3643
A flaw was found in sox 14.4.1
8.8
CVE-2021-40426
A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e
7.8
CVE-2023-34432
A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16
7.8
CVE-2023-34318
A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41
7.5
CVE-2017-18189
In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer…