media-sound/sox-14.4.4.1-r1 — Security Advisories

▸ GLSA 201810-02 SoX: Multiple vulnerabilities this version unaffected normal remote 2018-10-06

Multiple vulnerabilities have been found in SoX, the worst of which may lead to a Denial of Service condition.

Announced: 2018-10-06
Revised: 2018-10-06
Access: remote
Bugs: #626702 #627570 #634450 #634814
Advisory: https://security.gentoo.org/glsa/201810-02

Affected packages

Package	Arch	Vulnerable	Unaffected
media-sound/sox	*	< 14.4.2-r1	>= 14.4.2-r1

Background

SoX is a command line utility that can convert various formats of computer audio files in to other formats.

Description

Multiple vulnerabilities have been discovered in SoX. Please review the referenced CVE identifiers for details.

Impact

A remote attacker, by enticing a user to process a crafted WAV, HCOM, SND, or AIFF file, could cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All SoX users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-sound/sox-14.4.2-r1"

References

▸ GLSA 201612-30 SoX: User-assisted execution of arbitrary code this version unaffected normal remote 2016-12-11

Multiple heap overflows in SoX may allow remote attackers to execute arbitrary code.

Announced: 2016-12-11
Revised: 2016-12-11
Access: remote
Bugs: #533296
Advisory: https://security.gentoo.org/glsa/201612-30

Affected packages

Package	Arch	Vulnerable	Unaffected
media-sound/sox	*	< 14.4.2	>= 14.4.2

Background

SoX is a command line utility that can convert various formats of computer audio files in to other formats.

Description

A heap-based buffer overflow can be triggered when processing a malicious NIST Sphere or WAV audio file.

Impact

A remote attacker could coerce the victim to run SoX against their malicious file. This may be leveraged by an attacker to gain control of program execution with the privileges of the user.

Workaround

There is no known workaround at this time.

Resolution

All SoX users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-sound/sox-14.4.2"

References

CVE-2014-8145

▸ GLSA 200407-23 SoX: Multiple buffer overflows this version unaffected normal remote 2004-07-30

SoX contains two buffer overflow vulnerabilities in the WAV header parser code.

Announced: 2004-07-30
Revised: 2006-05-22 (revision 2)
Access: remote
Bugs: #58733
Advisory: https://security.gentoo.org/glsa/200407-23

Affected packages

Package	Arch	Vulnerable	Unaffected
media-sound/sox	*	<= 12.17.4-r1	>= 12.17.4-r2

Background

SoX is a command line utility that can convert various formats of computer audio files in to other formats.

Description

Ulf Harnhammar discovered two buffer overflows in the sox and play commands when handling WAV files with specially crafted header fields.

Impact

By enticing a user to play or convert a specially crafted WAV file an attacker could execute arbitrary code with the permissions of the user running SoX.

Workaround

There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of SoX.

Resolution

All SoX users should upgrade to the latest version:

# emerge sync

# emerge -pv ">=media-sound/sox-12.17.4-r2"
# emerge ">=media-sound/sox-12.17.4-r2"