Buffer overflow in Sound_exchange_project Sound_exchange
CVE-2019-8356
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
EPSS: 0.018 (76.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
Affected products
- Sound_exchange_project Sound_exchange — versions 14.4.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_MLIST)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory)
Frequently asked questions
- What is CVE-2019-8356?
- CVE-2019-8356 is a medium-severity vulnerability in Sound_exchange_project Sound_exchange, classified under Improper Validation of Array Index. CVSS score: 5.5/10. Published 2019-02-15.
- How severe is CVE-2019-8356?
- Medium severity. CVSS v3 base score is 5.5 out of 10.