リモートの CentOS Linux 8 ホストにインストールされているパッケージは、CESA-2022: 1968 アドバイザリに記載されている脆弱性の影響を受けます。

  - libsndfile: flac_buffer_copy の src/flac.c のヒープ領域外読み取り (CVE-2021-4156)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ頼っていることに注意してください。

リモートの Ubuntu 16.04LTS ホストには、USN-5409-1のアドバイザリに記載された脆弱性の影響を受けるパッケージがインストールされています。

  - libsndfile の FLAC コーデック機能に、領域外読み取りの欠陥が見つかりました。特別に細工されたファイルを (ユーザーを騙して開くなどの方法で) libsndfile にリンクされたアプリケーションに送信し、FLAC コーデックを使用できる攻撃者は、領域外読み取りを発生させる可能性があります。これによりクラッシュが引き起こされる可能性が最も高くなりますが、メモリ情報が漏洩し、他の欠陥の悪用に利用される可能性があります。(CVE-2021-4156)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ頼っていることに注意してください。

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1968 advisory.

  - An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to     submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with     libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a     crash but could potentially leak memory information that could be used in further exploitation of other     flaws. (CVE-2021-4156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to     submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with     libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a     crash but could potentially leak memory information that could be used in further exploitation of other     flaws. (CVE-2021-4156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-175 advisory.

  - An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to     submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with     libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a     crash but could potentially leak memory information that could be used in further exploitation of other     flaws. (CVE-2021-4156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-028 advisory.

  - An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to     submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with     libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a     crash but could potentially leak memory information that could be used in further exploitation of other     flaws. (CVE-2021-4156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:1968 advisory.

  - libsndfile: heap out-of-bounds read in src/flac.c in flac_buffer_copy (CVE-2021-4156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5409-1 advisory.

  - An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to     submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with     libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a     crash but could potentially leak memory information that could be used in further exploitation of other     flaws. (CVE-2021-4156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:1968 advisory.

  - An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to     submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with     libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a     crash but could potentially leak memory information that could be used in further exploitation of other     flaws. (CVE-2021-4156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0034-1 advisory.

  - An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to     submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with     libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a     crash but could potentially leak memory information that could be used in further exploitation of other     flaws. (CVE-2021-4156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
160922	CentOS 8: libsndfile (CESA-2022: 1968)	Nessus	CentOS Local Security Checks	2022/5/10	2023/10/27	high
160977	Ubuntu 16.04 ESM: libsndfileの脆弱性 (USN-5409-1)	Nessus	Ubuntu Local Security Checks	2022/5/11	2023/10/20	high
184683	Rocky Linux 8 : libsndfile (RLSA-2022:1968)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	high
162371	EulerOS 2.0 SP5 : libsndfile (EulerOS-SA-2022-1899)	Nessus	Huawei Local Security Checks	2022/6/17	2023/10/19	high
167027	Amazon Linux 2022 : (ALAS2022-2022-175)	Nessus	Amazon Linux Local Security Checks	2022/11/5	2023/10/5	high
173093	Amazon Linux 2023 : libsndfile, libsndfile-devel, libsndfile-utils (ALAS2023-2023-028)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2023/4/21	high
160922	CentOS 8 : libsndfile (CESA-2022:1968)	Nessus	CentOS Local Security Checks	2022/5/10	2023/10/27	high
160977	Ubuntu 16.04 ESM : libsndfile vulnerability (USN-5409-1)	Nessus	Ubuntu Local Security Checks	2022/5/11	2023/10/20	high
161157	AlmaLinux 8 : libsndfile (ALSA-2022:1968)	Nessus	Alma Linux Local Security Checks	2022/5/13	2023/10/27	high
156477	SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2022:0034-1)	Nessus	SuSE Local Security Checks	2022/1/6	2023/7/14	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high