CVE-2015-7805
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified...
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
- Record
CVE-2015-7805- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
- Record
CVE-2015-7805- Updated
- 2026-11-02
EUVDEUVD-2015-7704 No score
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
- Record
EUVD-2015-7704- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-55v7-29g7-7rj7 No score
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified...
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
- Record
GHSA-55v7-29g7-7rj7- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
- Record
CVE-2015-7805- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-7805 No score
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
- Record
DEBIAN-CVE-2015-7805- Updated
- 2026-11-02
Show 8 moreShow less
OSVMGASA-2015-0455 No score
Updated libsndfile packages fix security vulnerability
Due to a heap overflow in libsndfile, a specially crafted AIFF header can manage index values in order to use memcpy to overwrite memory the heap (CVE-2015-7805).
- Record
MGASA-2015-0455- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10148-1 No score
libsndfile-devel-1.0.26-2.4 on GA media
These are all security issues fixed in the libsndfile-devel-1.0.26-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10148-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10470-1 No score
libsndfile-progs-1.0.26-2.4 on GA media
These are all security issues fixed in the libsndfile-progs-1.0.26-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10470-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1979-1 No score
Security update for libsndfile
The libsndfile package was updated to fix the following security issue:
- CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service (DoS) (bsc#953521).
- CVE-2015-7805: Fixed heap overflow issue (bsc#953516).
- Record
SUSE-SU-2015:1979-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2000-1 No score
Security update for libsndfile
The libsndfile package was updated to fix the following security issue:
- CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service (DoS) (bsc#953521).
- CVE-2015-7805: Fixed heap overflow issue (bsc#953516).
- CVE-2015-8075: Fixed heap overflow issue (bsc#953519).
- Record
SUSE-SU-2015:2000-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2000-2 No score
Security update for libsndfile
The libsndfile package was updated to fix the following security issue:
- CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service (DoS) (bsc#953521).
- CVE-2015-7805: Fixed heap overflow issue (bsc#953516).
- CVE-2015-8075: Fixed heap overflow issue (bsc#953519).
- Record
SUSE-SU-2015:2000-2- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7805 No score
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
- Record
UBUNTU-CVE-2015-7805- Updated
- 2026-11-02
OSVUSN-2832-1 No score
libsndfile vulnerabilities
It was discovered that libsndfile incorrectly handled memory when parsing malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9496)
Joshua Rogers discovered that libsndfile incorrectly handled division when parsing malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service. (CVE-2014-9756)
Marco Romano discovered that libsndfile incorrectly handled certain malformed AIFF files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-7805)
- Record
USN-2832-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsndfileDebian:12 |
before 1.0.25-10 | 1.0.25-10 |
libsndfileDebian:13 |
before 1.0.25-10 | 1.0.25-10 |
libsndfileDebian:14 |
before 1.0.25-10 | 1.0.25-10 |
libsndfileDebian:6.0 |
before 1.0.21-3+squeeze2, plus listed versions 1.0.21-31.0.21-3+squeeze11.0.21-3+squeeze1~bpo50+1 |
1.0.21-3+squeeze2 |
libsndfileDebian:7 |
before 1.0.25-9.1+deb7u1, plus listed versions 1.0.25-51.0.25-61.0.25-71.0.25-81.0.25-91.0.25-9.1 |
1.0.25-9.1+deb7u1 |
libsndfileMageia:5 |
before 1.0.25-9.1.mga5 | 1.0.25-9.1.mga5 |
libsndfileSUSE:Linux Enterprise Software Development Kit 11 SP3 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Desktop 11 SP3 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Desktop 11 SP4 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libsndfileSUSE:Linux Enterprise Server 11 SP3 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Server 11 SP3-TERADATA |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 11 SP3 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Server 11 SP4 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.0.20-2.10.2 | 1.0.20-2.10.2 |
libsndfileSUSE:Linux Enterprise Desktop 12 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Software Development Kit 12 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Server 12 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Desktop 12 SP1 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Server 12 SP1 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.0.25-25.1 | 1.0.25-25.1 |
libsndfileUbuntu:14.04:LTS |
before 1.0.25-7ubuntu2.1, plus listed versions 1.0.25-7ubuntu11.0.25-7ubuntu2 |
1.0.25-7ubuntu2.1 |
libsndfileopenSUSE:Tumbleweed |
before 1.0.26-2.4 | 1.0.26-2.4 |
libsndfile-progsopenSUSE:Tumbleweed |
before 1.0.26-2.4 | 1.0.26-2.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | libsndfile 1.0.25 - Local Heap Overflow | 2015-10-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7805 is a high vulnerability (CVSS 9.3) in Mega-nerd Libsndfile, published November 12, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.3%, the 96th percentile. Fixed in libsndfile 1.0.25-10.
References
openwall.com/lists/oss-security/2015/11/03/7
lists.opensuse.org/opensuse-updates/2015-11/msg00077.html
securityfocus.com/bid/77427
packetstormsecurity.com/files/133926/libsndfile-1.0.25-Heap-Overflow.html
ubuntu.com/usn/USN-2832-1
security.gentoo.org/glsa/201612-03
Show 29 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2015-November/172607.html
nemux.org/2015/10/13/libsndfile-1-0-25-heap-overflow
exploit-db.com/exploits/38447
nvd.nist.gov/vuln/detail/CVE-2015-7805
github.com/advisories/GHSA-55v7-29g7-7rj7
security-tracker.debian.org/tracker/CVE-2015-7805
advisories.mageia.org/MGASA-2015-0455.html
bugs.mageia.org/show_bug.cgi?id=17163
suse.com/support/update/announcement/2015/suse-su-20151979-1
bugzilla.suse.com/953516
ubuntu.com/security/CVE-2015-7805
cve.org/CVERecord?id=CVE-2015-7805