CVE-2023-34432
Assigner: redhat
Published: 2023-07-10T20:05:39.681Z
State: PUBLISHED
title: Heap-buffer-overflow in src/formats_i.c
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
descriptions: value: A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.
affected: product: sox
vendor: n/a
defaultStatus: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sox
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:6
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sox
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: sox
defaultStatus: affected
product: Extra Packages for Enterprise Linux
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: sox
defaultStatus: affected
datePublic: 2023-05-05T00:00:00Z
problemTypes: descriptions: cweId: CWE-122
description: Heap-based Buffer Overflow
type: CWE
x_redhatCweChain: CWE-122: Heap-based Buffer Overflow
timeline: time: 2023-05-11T00:00:00Z
value: Reported to Red Hat.
time: 2023-05-05T00:00:00Z
value: Made public.