Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-9756: libsndfile can crash during audio processing

CVE-2014-9756 · published 10 years ago

Summary

The libsndfile library, used in Ubuntu and openSUSE Linux systems, has a flaw that can cause the program to stop working unexpectedly. This happens when certain audio data triggers a calculation error, leading to a crash. Install the latest updates for libsndfile from your Linux distribution to fix the issue.

What to do

Update libsndfile_project libsndfile to version 1.0.26 or later.

Affected software

Vendor	Product	Affected versions
libsndfile_project	libsndfile	< 1.0.26 `cpe:2.3:a:libsndfile_project:libsndfile::::::::`
canonical	ubuntu_linux	12.04 14.04 15.04 15.10 `cpe:2.3:o:canonical:ubuntu_linux:12.04::::esm:::`
opensuse	leap	42.1 `cpe:2.3:o:opensuse:leap:42.1:::::::*`
opensuse	opensuse	13.1 13.2 `cpe:2.3:o:opensuse:opensuse:13.1:::::::*`

Original advisory text

The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.

References

http://lists.opensuse.org/opensuse-updates/2015-11/msg00077.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-11/msg00145.html Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/12/24/3 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/11/03/9 Mailing List Patch Third Party Advisory
http://www.ubuntu.com/usn/USN-2832-1 Third Party Advisory
https://github.com/erikd/libsndfile/commit/725c7dbb95bfaf8b4bb7b04820e3a00cceea9... Patch Third Party Advisory
https://github.com/erikd/libsndfile/issues/92 Exploit Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

3% chance of attack within 30 days

Type

CWE-369Divide By Zero

Timeline

Published19 Nov 2015

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2014-9756 · NVD

Track software like this

Free during beta