An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
The product reads data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2027690 | third party advisory issue tracking exploit |
| https://github.com/libsndfile/libsndfile/pull/732/commits/4c30646abf7834e406f7e2429c70bc254e18beab | third party advisory patch |
| https://github.com/libsndfile/libsndfile/issues/731 | third party advisory issue tracking exploit |
| https://lists.debian.org/debian-lts-announce/2022/06/msg00020.html | third party advisory mailing list |
| https://lists.debian.org/debian-lts-announce/2022/09/msg00036.html | third party advisory mailing list |
| https://security.gentoo.org/glsa/202309-11 | vendor advisory |