Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.

A heap-overflow in libaudiofile was fixed. The overflow existsed in the WAV processing code and can be exploited to execute arbitrary code.

This update also contains fixed audiofile-32bit packages.

It was discovered that Audio File Library contained a heap-based buffer overflow. If a user or automated system processed a crafted WAV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. The default compiler options for Ubuntu should reduce this vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Max Kellermann discovered a heap-based buffer overflow in the handling of ADPCM WAV files in libaudiofile. This flaw could result in a denial of service (application crash) or possibly execution of arbitrary code via a crafted WAV file.

The old stable distribution (etch), this problem will be fixed in version 0.2.6-6+etch1.

The packages for the oldstable distribution are not included in this advisory. An update will be released soon.

A heap-overflow in libaudiofile was fixed. The overflow existsed in the WAV processing code and can be exploited to execute arbitrary code. (CVE-2008-5824)

A heap-overflow in libaudiofile was fixed. The overflow existed in the WAV processing code and can be exploited to execute arbitrary code.
(CVE-2008-5824)

ID	Name	Product	Family	Severity
57159	SuSE 10 Security Update : audiofile (ZYPP Patch Number 7394)	Nessus	SuSE Local Security Checks	medium
53233	SuSE 10 Security Update : audiofile (ZYPP Patch Number 7315)	Nessus	SuSE Local Security Checks	medium
45079	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : audiofile vulnerability (USN-912-1)	Nessus	Ubuntu Local Security Checks	medium
44837	Debian DSA-1972-1 : audiofile - buffer overflow	Nessus	Debian Local Security Checks	medium
41478	SuSE 10 Security Update : audiofile (ZYPP Patch Number 5948)	Nessus	SuSE Local Security Checks	medium
41272	SuSE9 Security Update : audiofile (YOU Patch Number 12342)	Nessus	SuSE Local Security Checks	medium
40191	openSUSE Security Update : audiofile (audiofile-457)	Nessus	SuSE Local Security Checks	medium
39918	openSUSE Security Update : audiofile (audiofile-457)	Nessus	SuSE Local Security Checks	medium
35470	openSUSE 10 Security Update : audiofile (audiofile-5950)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2008-5824

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium