The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3650 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3650-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     November 12, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : audiofile     Version        : 0.3.6-5+deb10u1     CVE ID         : CVE-2019-13147 CVE-2022-24599     Debian Bug     : 931343 1008017

    The audiofile library allows the processing of audio data to and     from audio files of many common formats (currently AIFF, AIFF-C,     WAVE, NeXT/Sun, BICS, and raw data).

    CVE-2019-13147

        Audiofile was vulnerable due to an integer overflow.
        Bail out early if NeXT audio files include too many channels.

    CVE-2022-24599

        A memory leak was found due to reading not null         terminated copyright field. Preallocate zeroed memory and         always NUL terminates C strings.

    For Debian 10 buster, these problems have been fixed in version     0.3.6-5+deb10u1.

    We recommend that you upgrade your audiofile packages.

    For the detailed security status of audiofile please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/audiofile

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6558-1 advisory.

    It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated     system were tricked into opening a specially crafted file, an attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2018-13440)

    It was discovered that audiofile could be made to write out of bounds. If a user or an automated system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04     LTS. (CVE-2018-17095)

    It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated     system were tricked into opening a specially crafted file, an attacker could possibly use this issue to     cause a denial of service. (CVE-2019-13147)

    It was discovered that audiofile could be made to leak memory. If a user or an automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to obtain     sensitive information. (CVE-2022-24599)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the audiofile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in     printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo     function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the     data. (CVE-2022-24599)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in     printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo     function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the     data. (CVE-2022-24599)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-47d4f575a3 advisory.

    Patch for CVE-2022-24599

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-e23e432cb2 advisory.

    Patch for CVE-2022-24599

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-07669abb35 advisory.

    Patch for CVE-2022-24599

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of audiofile installed on the remote host is prior to 0.3.6-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1997 advisory.

    In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in     printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo     function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the     data. (CVE-2022-24599)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
185477	Debian dla-3650 : audiofile-tools - security update	Nessus	Debian Local Security Checks	11/12/2023	1/22/2025	medium
186992	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : audiofile vulnerabilities (USN-6558-1)	Nessus	Ubuntu Local Security Checks	12/15/2023	8/28/2024	high
191815	EulerOS 2.0 SP8 : audiofile (EulerOS-SA-2024-1255)	Nessus	Huawei Local Security Checks	3/12/2024	3/12/2024	medium
224574	Linux Distros Unpatched Vulnerability : CVE-2022-24599	Nessus	Misc.	3/5/2025	3/5/2025	medium
186145	Fedora 39 : audiofile (2023-47d4f575a3)	Nessus	Fedora Local Security Checks	11/21/2023	11/14/2024	medium
186141	Fedora 37 : audiofile (2023-e23e432cb2)	Nessus	Fedora Local Security Checks	11/21/2023	11/14/2024	medium
186142	Fedora 38 : audiofile (2023-07669abb35)	Nessus	Fedora Local Security Checks	11/21/2023	11/14/2024	medium
173196	Amazon Linux 2 : audiofile (ALAS-2023-1997)	Nessus	Amazon Linux Local Security Checks	3/22/2023	12/11/2024	medium

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

medium

medium

medium