Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Debian SOX may crash when processing audio

CVE-2023-32627 · published 3 years ago
Summary

The SOX audio tool on Debian can hit an error when it reads certain audio files, causing the program to stop working. This can interrupt any workflow that relies on SOX for audio conversion or processing. Update to the latest Debian package or apply the provided patch to prevent the crash.

What to do
  • Update debian sox to version 14.4.2+git20190427-4.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian sox All versions
Debian:13 debian sox < 14.4.2+git20190427-4
Fix: upgrade to 14.4.2+git20190427-4
– sound_exchange_project sound_exchange 14.4.3
cpe:2.3:a:sound_exchange_project:sound_exchange:14.4.3:*:*:*:*:*:*:*
– fedoraproject extra_packages_for_enterprise_linux 8.0
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
– fedoraproject fedora 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
– redhat enterprise_linux 6.0
7.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
Original advisory text
A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a denial of service.
A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a denial of service.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-1077Floating Point Comparison with Incorrect Operator
CWE-697Incorrect Comparison
Timeline
Published10 Jul 2023
Updated3 Nov 2026
First seen15 Sep 2026
Sources
DEBIAN-CVE-2023-32627 · OSV
CVE-2023-32627 · NVD
Track software like this
Free during beta