low2.1

CVE-2014-9496

The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker,…

Impact

The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.

Affected products

Vendor	Product	Affected versions
Libsndfile Project	Libsndfile	before 1.0.26
Opensuse	Opensuse	Versions 13.1, 13.2
Debian	Debian Linux	Version 9.0
Canonical	Ubuntu Linux	Versions 12.04, 14.04, 15.04, 15.10
Oracle	Solaris	Version 11.2

References

NVD record
CVE.org record
http://advisories.mageia.org/MGASA-2015-0015.html
http://lists.opensuse.org/opensuse-updates/2015-01/msg00016.html
http://secunia.com/advisories/62320
http://www.mandriva.com/security/advisories?name=MDVSA-2015:024
http://www.openwall.com/lists/oss-security/2015/01/04/4
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.securityfocus.com/bid/71796
http://www.ubuntu.com/usn/USN-2832-1
https://github.com/erikd/libsndfile/commit/dbe14f00030af5d3577f4cabbf9861db59e9c378
https://github.com/erikd/libsndfile/issues/93
https://seclists.org/bugtraq/2019/Apr/23
https://security.gentoo.org/glsa/201612-03
http://advisories.mageia.org/MGASA-2015-0015.html
http://lists.opensuse.org/opensuse-updates/2015-01/msg00016.html
http://secunia.com/advisories/62320
http://www.mandriva.com/security/advisories?name=MDVSA-2015:024
http://www.openwall.com/lists/oss-security/2015/01/04/4
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.securityfocus.com/bid/71796
http://www.ubuntu.com/usn/USN-2832-1
https://github.com/erikd/libsndfile/commit/dbe14f00030af5d3577f4cabbf9861db59e9c378
https://github.com/erikd/libsndfile/issues/93
https://seclists.org/bugtraq/2019/Apr/23
https://security.gentoo.org/glsa/201612-03