CVE-2019-8354

moderate-risk

Published 2019-02-15

An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.

Do I need to act?

0.70% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.0/10 Medium

LOCAL / LOW complexity

Affected Products (5)

Sound Exchange

Debian Linux

Ubuntu Linux

Affected Vendors

Debian Canonical Sound Exchange Project

References (8)

Mailing List https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html

Issue Tracking https://sourceforge.net/p/sox/bugs/319

Third Party Advisory https://usn.ubuntu.com/4079-1/

Third Party Advisory https://usn.ubuntu.com/4079-2/

Mailing List https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html

Issue Tracking https://sourceforge.net/p/sox/bugs/319

Third Party Advisory https://usn.ubuntu.com/4079-1/

Third Party Advisory https://usn.ubuntu.com/4079-2/

/ 100

moderate-risk

Severity 17/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 12/34 · Low