Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2017-7604: libaacplus 2.0.2 can crash when processing crafted audio
CVE-2017-7604 · published 9 years ago
Summary
The libaacplus audio decoding library version 2.0.2 has a coding error that can be triggered by a specially crafted audio file. An attacker who sends such a file could cause the application using the library to stop working unexpectedly. Update to a newer version of libaacplus or apply the vendor's patch to prevent the crash.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| libaacplus_project | libaacplus |
2.0.2 cpe:2.3:a:libaacplus_project:libaacplus:2.0.2:*:*:*:*:*:*:* |
Original advisory text
au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have ...
au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.
References
- https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-... Exploit Third Party Advisory
- https://security.gentoo.org/glsa/202209-13 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published9 Apr 2017
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-7604 · NVD
Track software like this
Free during beta