{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-04-07T00:00:00", "descriptions": [{"lang": "en", "value": "In libsndfile before 1.0.28, an error in the \"header_read()\" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T09:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/erikd/libsndfile/commit/708e996c87c5fae77b104ccfeb8f6db784c32074"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.mega-nerd.com/libsndfile/#History"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.mega-nerd.com/libsndfile/NEWS"}, {"name": "GLSA-201707-04", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201707-04"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/erikd/libsndfile/commit/f457b7b5ecfe91697ed01cfc825772c4d8de1236"}, {"name": "97522", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/97522"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-7586", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In libsndfile before 1.0.28, an error in the \"header_read()\" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/erikd/libsndfile/commit/708e996c87c5fae77b104ccfeb8f6db784c32074", "refsource": "CONFIRM", "url": "https://github.com/erikd/libsndfile/commit/708e996c87c5fae77b104ccfeb8f6db784c32074"}, {"name": "http://www.mega-nerd.com/libsndfile/#History", "refsource": "CONFIRM", "url": "http://www.mega-nerd.com/libsndfile/#History"}, {"name": "http://www.mega-nerd.com/libsndfile/NEWS", "refsource": "CONFIRM", "url": "http://www.mega-nerd.com/libsndfile/NEWS"}, {"name": "GLSA-201707-04", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201707-04"}, {"name": "https://github.com/erikd/libsndfile/commit/f457b7b5ecfe91697ed01cfc825772c4d8de1236", "refsource": "CONFIRM", "url": "https://github.com/erikd/libsndfile/commit/f457b7b5ecfe91697ed01cfc825772c4d8de1236"}, {"name": "97522", "refsource": "BID", "url": "http://www.securityfocus.com/bid/97522"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:04:11.873Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/erikd/libsndfile/commit/708e996c87c5fae77b104ccfeb8f6db784c32074"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.mega-nerd.com/libsndfile/#History"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.mega-nerd.com/libsndfile/NEWS"}, {"name": "GLSA-201707-04", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201707-04"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/erikd/libsndfile/commit/f457b7b5ecfe91697ed01cfc825772c4d8de1236"}, {"name": "97522", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/97522"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-7586", "datePublished": "2017-04-07T20:00:00", "dateReserved": "2017-04-07T00:00:00", "dateUpdated": "2024-08-05T16:04:11.873Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libsndfile_project:libsndfile:*:*:*:*:*:*:*:*", "matchCriteriaId": "59548F6B-A7DD-4844-8347-79E7FEBF8280", "versionEndIncluding": "1.0.27", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In libsndfile before 1.0.28, an error in the \"header_read()\" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file."}, {"lang": "es", "value": "En libsndfile en versiones anteriores a 1.0.28, un error en la funci\u00f3n \"header_read()\" (common.c) cuando se manejan etiquetas ID3 pueden ser explotados para provocar un desbordamiento de b\u00fafer basado en pila a trav\u00e9s de un archivo FLAC especialmente manipulado."}], "id": "CVE-2017-7586", "lastModified": "2024-11-21T03:32:13.200", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-07T20:59:00.220", "references": [{"source": "cve@mitre.org", "tags": ["Product", "Release Notes"], "url": "http://www.mega-nerd.com/libsndfile/#History"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "http://www.mega-nerd.com/libsndfile/NEWS"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/97522"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/erikd/libsndfile/commit/708e996c87c5fae77b104ccfeb8f6db784c32074"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/erikd/libsndfile/commit/f457b7b5ecfe91697ed01cfc825772c4d8de1236"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201707-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Release Notes"], "url": "http://www.mega-nerd.com/libsndfile/#History"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "http://www.mega-nerd.com/libsndfile/NEWS"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/97522"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/erikd/libsndfile/commit/708e996c87c5fae77b104ccfeb8f6db784c32074"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/erikd/libsndfile/commit/f457b7b5ecfe91697ed01cfc825772c4d8de1236"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201707-04"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "libsndfile: Error in header_read() causing stack-based buffer overflow", "id": "1440758", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1440758"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-121", "details": ["In libsndfile before 1.0.28, an error in the \"header_read()\" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.", "A buffer overflow flaw was found in the way libsndfile handled ID3 tags. This flaw could potentially be used to crash the application using libsndfile by tricking the application into processing specially crafted FLAC files."], "name": "CVE-2017-7586", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libsndfile", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "libsndfile", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2017-03-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-7586\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-7586"], "threat_severity": "Low", "upstream_fix": "libsndfile 1.0.28"}