CVE-2017-18189
Fixed in a distro release EPSS 5%
In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service.
Products: sound_exchange_project sound_exchange, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | sox | 14.4.1-7.amzn2 |
| Amazon Linux 2 | sox-devel | 14.4.1-7.amzn2 |
| Arch Linux | sox | 14.4.2-3 |
| Debian 12 | sox | 14.4.2-2 |
| Debian 13 | sox | 14.4.2-2 |
| Debian 7 | sox | 14.4.0-3+deb7u2 |
| Debian 8 | sox | 14.4.1-5+deb8u2 |
| Red Hat Enterprise Linux 7 | sox | 0:14.4.1-7.el7 |
| Red Hat Enterprise Linux 7 | sox-debuginfo | 0:14.4.1-7.el7 |
| Red Hat Enterprise Linux 7 | sox-devel | 0:14.4.1-7.el7 |
| SUSE Package Hub 12 SP3 | sox | 14.4.2-5.1 |
| Ubuntu 14.04 LTS | sox | 14.4.1-3ubuntu1.1 |
| Ubuntu 16.04 LTS | sox | 14.4.1-5ubuntu0.1 |
| openSUSE Tumbleweed | sox | 14.4.2-5.17 |