CVE-2017-7697
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in...
CVE-2017-7697 is a medium vulnerability (CVSS 5.5) in Libsamplerate Project Libsamplerate, published April 11, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in libsamplerate 0.1.9-r0.
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- Record
CVE-2017-7697- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- Record
CVE-2017-7697- Updated
- 2026-11-02
EUVDEUVD-2017-16673 No score
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- Record
EUVD-2017-16673- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qm8v-gjcq-7m6j
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in...
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- Record
GHSA-qm8v-gjcq-7m6j- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-7697
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- Record
ALPINE-CVE-2017-7697- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- Record
CVE-2017-7697- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2017-7697
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- Record
DEBIAN-CVE-2017-7697- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-7697
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- Record
UBUNTU-CVE-2017-7697- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0131 No score
Updated libsamplerate packages fix security vulnerability
It was discovered that libsamplerate contained a global buffer overflow in calc_output_single (CVE-2017-7697).
- Record
MGASA-2017-0131- Updated
- 2026-11-02
OSVSUSE-SU-2017:1065-1 No score
Security update for libsamplerate
This update for libsamplerate fixes the following issues:
- CVE-2017-7697: Fixed a buffer overflow in calc_output_single. (bsc#1033564)
- Record
SUSE-SU-2017:1065-1- Updated
- 2026-11-02
OSVUSN-5749-1 No score
libsamplerate vulnerability
Erik de Castro Lopo and Agostino Sarubbo discovered that libsamplerate did not properly perform bounds checking. If a user were tricked into processing a specially crafted audio file, an attacker could possibly use this issue to cause a crash.
- Record
USN-5749-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsamplerateAlpine:v3.2 |
before 0.1.9-r0 | 0.1.9-r0 |
libsamplerateAlpine:v3.3 |
before 0.1.9-r0 | 0.1.9-r0 |
libsamplerateAlpine:v3.4 |
before 0.1.9-r0 | 0.1.9-r0 |
libsamplerateDebian:12 |
before 0.1.9-1 | 0.1.9-1 |
libsamplerateDebian:13 |
before 0.1.9-1 | 0.1.9-1 |
libsamplerateDebian:14 |
before 0.1.9-1 | 0.1.9-1 |
libsamplerateDebian:9 |
before 0.1.8-8+deb9u1, plus listed versions 0.1.8-8 |
0.1.8-8+deb9u1 |
libsamplerateMageia:5 |
before 0.1.9-1.mga5 | 0.1.9-1.mga5 |
libsamplerateSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 0.1.4-3.1 | 0.1.4-3.1 |
libsamplerateSUSE:Linux Enterprise Server 11 SP4 |
before 0.1.4-3.1 | 0.1.4-3.1 |
libsamplerateSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 0.1.4-3.1 | 0.1.4-3.1 |
libsamplerateUbuntu:14.04:LTS |
All versions, plus listed versions 0.1.8-5ubuntu10.1.8-5ubuntu20.1.8-6ubuntu10.1.8-7 |
None known |
libsamplerateUbuntu:Pro:16.04:LTS |
before 0.1.8-8ubuntu0.1~esm1, plus listed versions 0.1.8-8 |
0.1.8-8ubuntu0.1~esm1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/erikd/libsamplerate/issues/11
securityfocus.com/bid/97587
lists.debian.org/debian-lts-announce/2021/12/msg00010.html
nvd.nist.gov/vuln/detail/CVE-2017-7697
security.alpinelinux.org/vuln/CVE-2017-7697
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2017-7697
advisories.mageia.org/MGASA-2017-0131.html
bugs.mageia.org/show_bug.cgi?id=20672
openwall.com/lists/oss-security/2017/04/12/1
blogs.gentoo.org/ago/2017/04/11/libsamplerate-global-buffer-overflow-in-calc_output_single-src_sinc-c
suse.com/support/update/announcement/2017/suse-su-20171065-1
bugzilla.suse.com/1033564
ubuntu.com/security/CVE-2017-7697
cve.org/CVERecord?id=CVE-2017-7697