CVE-2015-7805

Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.

Score

CVSS 2.0 9.3 Critical

Status

Modified - cve@mitre.org

Published

2015-11-17

Last modified

2024-08-06

Weaknesses

CWE-119

Affected products

• Libsndfile (Mega-nerd)
• Opensuse (Opensuse)

References

• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171466.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172593.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172607.html
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00077.html
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00145.html
• http://packetstormsecurity.com/files/133926/libsndfile-1.0.25-Heap-Overflow.html
• http://www.nemux.org/2015/10/13/libsndfile-1-0-25-heap-overflow/
• http://www.openwall.com/lists/oss-security/2015/11/03/3
• http://www.openwall.com/lists/oss-security/2015/11/03/7
• http://www.securityfocus.com/bid/77427
• http://www.ubuntu.com/usn/USN-2832-1
• https://security.gentoo.org/glsa/201612-03
• https://www.exploit-db.com/exploits/38447/