VulnerabilityModified
CVE-2019-8355
In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc.
MEDIUM 5.5EPSS 1.69%
Does this matter?
Lower severity and a low EPSS score (1.69%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 1.69% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190, CWE-787
- Affected
- sound exchange project/sound exchange
- Source
- cve@mitre.org
References
- https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html
- https://sourceforge.net/p/sox/bugs/320Third Party Advisory
- https://usn.ubuntu.com/4079-1/
- https://usn.ubuntu.com/4079-2/
- https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html
- https://sourceforge.net/p/sox/bugs/320Third Party Advisory
- https://usn.ubuntu.com/4079-1/
- https://usn.ubuntu.com/4079-2/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.