Priority HIGH 79
A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02052 · Published 2022-04-14 · Will not fix CWE-122
Priority MEDIUM 43
Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.07709 · Published 2014-12-31 · Will not fix CWE-119
Priority MEDIUM 42
A flaw was found in sox 14.4.1.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01468 · Published 2022-05-02 · Will not fix CWE-125
Priority MEDIUM 41
In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker t…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.05055 · Published 2018-02-15 · Partial fix CWE-476
Priority LOW 36
A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00389 · Published 2023-07-10 · Will not fix CWE-122
Priority LOW 36
A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00275 · Published 2023-07-10 · Will not fix CWE-122
Priority LOW 35
The read_samples function in hcom.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted hcom file.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.07401 · Published 2017-07-31 · Will not fix CWE-125
Priority LOW 34
The wavwritehdr function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted snd file, during conversion to a wav file.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.06599 · Published 2017-07-31 · Will not fix CWE-369
Priority LOW 34
The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted wav file.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.06599 · Published 2017-07-31 · Will not fix CWE-369
Priority LOW 28
An issue was discovered in SoX 14.4.2.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01598 · Published 2019-02-15 · Fix deferred CWE-476
Priority LOW 28
An issue was discovered in SoX 14.4.2.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.018 · Published 2019-02-15 · Will not fix CWE-129
Priority LOW 28
An issue was discovered in SoX 14.4.2.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01707 · Published 2019-02-15 · Fix deferred CWE-190
Priority LOW 28
In lsx_aiffstartread in aiff.c in Sound eXchange (SoX) 14.4.2, there is a Use-After-Free vulnerability triggered by supplying a malformed AIFF file.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01495 · Published 2017-10-19 · Will not fix CWE-416
Priority LOW 28
There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 14.4.2.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01649 · Published 2017-10-16 · Will not fix CWE-119
Priority LOW 28
There is a reachable assertion abort in the function sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01629 · Published 2017-10-16 · Will not fix CWE-617
Priority LOW 28
There is a heap-based buffer overflow in the ImaExpandS function of ima_rw.c in Sound eXchange (SoX) 14.4.2.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01717 · Published 2017-10-16 · Will not fix CWE-119
Priority LOW 27
A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00282 · Published 2023-07-10 · Fix deferred CWE-1077
Priority LOW 27
A floating point exception vulnerability was found in sox, in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00207 · Published 2023-07-10 · No fix listed CWE-1077
Priority LOW 27
In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01114 · Published 2022-05-25 · Will not fix CWE-617
Priority LOW 27
In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01114 · Published 2022-05-25 · Will not fix CWE-697
Priority LOW 27
SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01263 · Published 2019-07-15 · Fix deferred CWE-125
Priority LOW 27
An issue was discovered in libsox.a in SoX 14.4.2.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01059 · Published 2019-07-14 · Fix deferred CWE-190
Priority LOW 26
An issue was discovered in SoX 14.4.2.
CVSS 3.1MEDIUM 5.0· Local · Low privileges · User interaction · EPSS 0.01633 · Published 2019-02-15 · Will not fix CWE-190
Priority LOW 25
A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00476 · Published 2022-08-25 · Fix deferred CWE-369
Priority LOW 25
A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00458 · Published 2022-08-25 · Fix deferred CWE-369
Load more
THREATIST.IORead the docs