CVE-2014-9756
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service ...
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
Exploit likelihood
What each source reports
NVD Score used
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
- Record
CVE-2014-9756- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-369
- Updated
- 2026-11-02
CVE List No score
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
- Record
CVE-2014-9756- Updated
- 2026-11-02
EUVDEUVD-2014-9562 No score
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
- Record
EUVD-2014-9562- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vc8h-g97p-fh5j No score
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service ...
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
- Record
GHSA-vc8h-g97p-fh5j- Weakness
- CWE-369
- Updated
- 2026-11-02
OSV No score
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
- Record
CVE-2014-9756- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9756 No score
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
- Record
DEBIAN-CVE-2014-9756- Updated
- 2026-11-02
Show 7 moreShow less
OSVopenSUSE-SU-2024:10148-1 No score
libsndfile-devel-1.0.26-2.4 on GA media
These are all security issues fixed in the libsndfile-devel-1.0.26-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10148-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10470-1 No score
libsndfile-progs-1.0.26-2.4 on GA media
These are all security issues fixed in the libsndfile-progs-1.0.26-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10470-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1979-1 No score
Security update for libsndfile
The libsndfile package was updated to fix the following security issue:
- CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service (DoS) (bsc#953521).
- CVE-2015-7805: Fixed heap overflow issue (bsc#953516).
- Record
SUSE-SU-2015:1979-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2000-1 No score
Security update for libsndfile
The libsndfile package was updated to fix the following security issue:
- CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service (DoS) (bsc#953521).
- CVE-2015-7805: Fixed heap overflow issue (bsc#953516).
- CVE-2015-8075: Fixed heap overflow issue (bsc#953519).
- Record
SUSE-SU-2015:2000-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2000-2 No score
Security update for libsndfile
The libsndfile package was updated to fix the following security issue:
- CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service (DoS) (bsc#953521).
- CVE-2015-7805: Fixed heap overflow issue (bsc#953516).
- CVE-2015-8075: Fixed heap overflow issue (bsc#953519).
- Record
SUSE-SU-2015:2000-2- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9756 No score
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
- Record
UBUNTU-CVE-2014-9756- Updated
- 2026-11-02
OSVUSN-2832-1 No score
libsndfile vulnerabilities
It was discovered that libsndfile incorrectly handled memory when parsing malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9496)
Joshua Rogers discovered that libsndfile incorrectly handled division when parsing malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service. (CVE-2014-9756)
Marco Romano discovered that libsndfile incorrectly handled certain malformed AIFF files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-7805)
- Record
USN-2832-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsndfileDebian:12 |
before 1.0.25-10 | 1.0.25-10 |
libsndfileDebian:13 |
before 1.0.25-10 | 1.0.25-10 |
libsndfileDebian:14 |
before 1.0.25-10 | 1.0.25-10 |
libsndfileDebian:6.0 |
before 1.0.21-3+squeeze2, plus listed versions 1.0.21-31.0.21-3+squeeze11.0.21-3+squeeze1~bpo50+1 |
1.0.21-3+squeeze2 |
libsndfileDebian:7 |
before 1.0.25-9.1+deb7u1, plus listed versions 1.0.25-51.0.25-61.0.25-71.0.25-81.0.25-91.0.25-9.1 |
1.0.25-9.1+deb7u1 |
libsndfileSUSE:Linux Enterprise Software Development Kit 11 SP3 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Desktop 11 SP3 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Desktop 11 SP4 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Server 11 SP3 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libsndfileSUSE:Linux Enterprise Server 11 SP3-TERADATA |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 11 SP3 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Server 11 SP4 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Desktop 12 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Software Development Kit 12 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Server 12 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Desktop 12 SP1 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Server 12 SP1 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileUbuntu:14.04:LTS |
before 1.0.25-7ubuntu2.1, plus listed versions 1.0.25-7ubuntu11.0.25-7ubuntu2 |
1.0.25-7ubuntu2.1 |
libsndfileopenSUSE:Tumbleweed |
before 1.0.26-2.4 | 1.0.26-2.4 |
libsndfile-progsopenSUSE:Tumbleweed |
before 1.0.26-2.4 | 1.0.26-2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9756 is a medium vulnerability (CVSS 5.0) in Libsndfile Project Libsndfile, published November 12, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in libsndfile 1.0.25-10.
References
lists.opensuse.org/opensuse-updates/2015-11/msg00077.html
github.com/erikd/libsndfile/issues/92
openwall.com/lists/oss-security/2014/12/24/3
ubuntu.com/usn/USN-2832-1
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-9756
security-tracker.debian.org/tracker/CVE-2014-9756
suse.com/support/update/announcement/2015/suse-su-20151979-1
bugzilla.suse.com/953516
ubuntu.com/security/CVE-2014-9756
cve.org/CVERecord?id=CVE-2014-9756