In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in     ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a     crafted file. (CVE-2019-13147)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6558-1 advisory.

    It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated     system were tricked into opening a specially crafted file, an attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2018-13440)

    It was discovered that audiofile could be made to write out of bounds. If a user or an automated system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04     LTS. (CVE-2018-17095)

    It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated     system were tricked into opening a specially crafted file, an attacker could possibly use this issue to     cause a denial of service. (CVE-2019-13147)

    It was discovered that audiofile could be made to leak memory. If a user or an automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to obtain     sensitive information. (CVE-2022-24599)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3650 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3650-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     November 12, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : audiofile     Version        : 0.3.6-5+deb10u1     CVE ID         : CVE-2019-13147 CVE-2022-24599     Debian Bug     : 931343 1008017

    The audiofile library allows the processing of audio data to and     from audio files of many common formats (currently AIFF, AIFF-C,     WAVE, NeXT/Sun, BICS, and raw data).

    CVE-2019-13147

        Audiofile was vulnerable due to an integer overflow.
        Bail out early if NeXT audio files include too many channels.

    CVE-2022-24599

        A memory leak was found due to reading not null         terminated copyright field. Preallocate zeroed memory and         always NUL terminates C strings.

    For Debian 10 buster, these problems have been fixed in version     0.3.6-5+deb10u1.

    We recommend that you upgrade your audiofile packages.

    For the detailed security status of audiofile please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/audiofile

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
222499	Linux Distros Unpatched Vulnerability : CVE-2019-13147	Nessus	Misc.	medium
186992	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : audiofile vulnerabilities (USN-6558-1)	Nessus	Ubuntu Local Security Checks	high
185477	Debian dla-3650 : audiofile-tools - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-13147

medium

Tenable Plugins

medium

high

medium