The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4704-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2017-12562)

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 ESM. (CVE-2017-14245, CVE-2017-14246, CVE-2017-14634,     CVE-2017-16942, CVE-2017-6892, CVE-2018-13139, CVE-2018-19432, CVE-2018-19661, CVE-2018-19662,     CVE-2018-19758, CVE-2019-3832)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-4553:01 advisory.

    * libsndfile: stack-based buffer overflow in sndfile-deinterleave utility (CVE-2018-13139)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libsndfile fixes the following issues :

Security issues fixed :

  - CVE-2018-13139: Fix a stack-based buffer overflow in     psf_memset in common.c that allows remote attackers to     cause a denial of service (bsc#1100167).

  - CVE-2017-17456: Prevent segmentation fault in the     function d2alaw_array() that may have lead to a remote     DoS (bsc#1071777)

  - CVE-2017-17457: Prevent segmentation fault in the     function d2ulaw_array() that may have lead to a remote     DoS, a different vulnerability than CVE-2017-14246     (bsc#1071767)

This update was imported from the SUSE:SLE-15:Update update project.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1185 advisory.

  - A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. (CVE-2018-13139)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1636 advisory.

    libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or     WAV.

    Security Fix(es):

    * libsndfile: stack-based buffer overflow in sndfile-deinterleave utility (CVE-2018-13139)

    * libsndfile: buffer over-read in the function i2alaw_array in alaw.c (CVE-2018-19662)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_1636 advisory.

    * libsndfile: stack-based buffer overflow in sndfile-deinterleave utility (CVE-2018-13139)

    * libsndfile: buffer over-read in the function i2alaw_array in alaw.c (CVE-2018-19662)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2615-1 advisory.

    - CVE-2018-13139: Fixed a stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28allows     remote attackers to cause a denial of service (application crash) or possibly have unspecified other     impact. (bsc#1100167)
    - CVE-2018-19432: Fixed a NULL pointer dereference in the function sf_write_int in sndfile.c, which will     lead to a denial of service. (bsc#1116993)
    - CVE-2021-3246: Fixed a heap buffer overflow vulnerability in msadpcm_decode_block. (bsc#1188540)
    - CVE-2018-19758: Fixed a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28     that will cause a denial of service. (bsc#1117954)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1636 advisory.

    - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function       i2alaw_array in alaw (#1673085)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
145464	Ubuntu 16.04 LTS : libsndfile vulnerabilities (USN-4704-1)	Nessus	Ubuntu Local Security Checks	2021/1/27	2025/9/3	critical
294187	MiracleLinux 7 : libsndfile-1.0.25-11.el7 (AXSA:2020-4553:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
123241	openSUSE Security Update : libsndfile (openSUSE-2019-562)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/11	high
135356	CentOS 7 : libsndfile (RHSA-2020:1185)	Nessus	CentOS Local Security Checks	2020/4/10	2024/10/9	high
136042	RHEL 8 : libsndfile (RHSA-2020:1636)	Nessus	Red Hat Local Security Checks	2020/4/28	2024/11/7	high
357465	Rocky Linux 8 [CIQ] Security Update: libsndfile / libsndfile-debuginfo / libsndfile-debugsource / etc Multiple Vulnerabilities (crlsa-2020_1636)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
152246	SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2021:2615-1)	Nessus	SuSE Local Security Checks	2021/8/6	2026/6/25	high
180978	Oracle Linux 8 : libsndfile (ELSA-2020-1636)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	high

検出

プラグインの検索

critical

high

high

high

high

high

high

high