CVE-2019-8356
Fixed in a distro release EPSS 2%
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
Products: sound_exchange_project sound_exchange
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | sox | 14.4.2+git20190427-1 |
| Debian 13 | sox | 14.4.2+git20190427-1 |
| Debian 8 | sox | 14.4.1-5+deb8u4 |
| Ubuntu 16.04 LTS | sox | 14.4.1-5+deb8u4ubuntu0.1 |
| Ubuntu 18.04 LTS | sox | 14.4.2-3ubuntu0.18.04.1 |
| Ubuntu Pro 14.04 LTS | sox | 14.4.1-3ubuntu1.1+esm1 |