Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Csound file conversion can let attackers run code

CVE-2012-2108 · published 12 years ago
Summary

Csound versions before 5.17.2 have a flaw in the part of the program that handles file conversion. If an attacker can get a user to open a specially crafted audio file, they could cause the program to run malicious code on the computer. Updating Csound to version 5.17.2 or later fixes the issue; otherwise, avoid opening untrusted files with Csound.

What to do
  • Update debian csound to version 1:5.17.6~dfsg-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian csound < 1:5.17.6~dfsg-1
Fix: upgrade to 1:5.17.6~dfsg-1
Debian:13 debian csound < 1:5.17.6~dfsg-1
Fix: upgrade to 1:5.17.6~dfsg-1
Debian:14 debian csound < 1:5.17.6~dfsg-1
Fix: upgrade to 1:5.17.6~dfsg-1
– csounds csound <= 5.17
5.10
5.10.1
5.11
5.11.1
5.12
5.12.1
5.12.3
5.12.4
5.13.0
5.13.1
5.14.0
5 more version ranges
cpe:2.3:a:csounds:csound:*:*:*:*:*:*:*:*
Original advisory text
Stack-based buffer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted f...
Stack-based buffer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file.
References
Severity
9.3 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published4 Feb 2014
Updated4 Nov 2026
First seen3 Sep 2026
Sources
DEBIAN-CVE-2012-2108 · OSV
CVE-2012-2108 · NVD
Track software like this
Free during beta