CVE-2017-17456
CVE-2017-17456 does not affect BellSoft software
CVE-2017-17456 has been rejected by its source and should not be treated as a live vulnerability, published December 7, 2017. Fixed in libsndfile 1.0.28-r6.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.28-r6libsndfile +33 more
Description
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-14245. Reason: This candidate is a duplicate of CVE-2017-14245. Notes: All CVE users should reference CVE-2017-14245 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsndfileAlpine:v3.10 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.11 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.12 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.13 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.14 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.15 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.16 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.17 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.18 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.19 | before 1.0.28-r6 | 1.0.28-r6 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libsndfileAlpine:v3.20 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.21 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.22 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.23 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.24 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileAlpine:v3.5 | before 1.0.28-r4 | 1.0.28-r4 |
libsndfileAlpine:v3.6 | before 1.0.28-r4 | 1.0.28-r4 |
libsndfileAlpine:v3.7 | before 1.0.28-r4 | 1.0.28-r4 |
libsndfileAlpine:v3.8 | before 1.0.28-r5 | 1.0.28-r5 |
libsndfileAlpine:v3.9 | before 1.0.28-r6 | 1.0.28-r6 |
libsndfileMageia:6 From an advisory covering 3 CVEs | before 1.0.28-3.3.mga6 | 1.0.28-3.3.mga6 |
libsndfileSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 3 CVEs | before 1.0.25-36.13.1 | 1.0.25-36.13.1 |
libsndfileSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 3 CVEs | before 1.0.25-36.13.1 | 1.0.25-36.13.1 |
libsndfileSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 3 CVEs | before 1.0.25-36.13.1 | 1.0.25-36.13.1 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 3 CVEs | before 1.0.25-36.13.1 | 1.0.25-36.13.1 |
libsndfileSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 3 CVEs | before 1.0.28-5.5.1 | 1.0.28-5.5.1 |
libsndfileSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 3 CVEs | before 1.0.20-2.19.12.1 | 1.0.20-2.19.12.1 |
libsndfileSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 3 CVEs | before 1.0.20-2.19.12.1 | 1.0.20-2.19.12.1 |
libsndfileSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 3 CVEs | before 1.0.20-2.19.12.1 | 1.0.20-2.19.12.1 |
libsndfileUbuntu:16.04:LTS | before 1.0.25-10ubuntu0.16.04.2, plus listed versions 1.0.25-9.11.0.25-101.0.25-10ubuntu0.16.04.1 | 1.0.25-10ubuntu0.16.04.2 |
libsndfileUbuntu:18.04:LTS | before 1.0.28-4ubuntu0.18.04.1, plus listed versions 1.0.28-4 | 1.0.28-4ubuntu0.18.04.1 |
libsndfileUbuntu:16.04:LTS From an advisory covering 13 CVEs | before 1.0.25-10ubuntu0.16.04.2, plus listed versions 1.0.25-9.11.0.25-101.0.25-10ubuntu0.16.04.1 | 1.0.25-10ubuntu0.16.04.2 |
libsndfileUbuntu:18.04:LTS From an advisory covering 13 CVEs | before 1.0.28-4ubuntu0.18.04.1, plus listed versions 1.0.28-4 | 1.0.28-4ubuntu0.18.04.1 |
libsndfileopenSUSE:Tumbleweed From an advisory covering 15 CVEs | before 1.0.31-2.2 | 1.0.31-2.2 |
What each source reports
CVE ListNo score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-14245. Reason: This candidate is a duplicate of CVE-2017-14245. Notes: All CVE users should reference CVE-2017-14245 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2017-17456- Updated
- 2026-11-02
EUVDEUVD-2017-8620No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-14245. Reason: This candidate is a duplicate of CVE-2017-14245. Notes: All CVE users should reference CVE-2017-14245 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
EUVD-2017-8620- Updated
- 2026-11-03
NVDNo score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-14245. Reason: This candidate is a duplicate of CVE-2017-14245. Notes: All CVE users should reference CVE-2017-14245 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2017-17456- Updated
- 2026-11-02
OSVALPINE-CVE-2017-17456No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-14245. Reason: This candidate is a duplicate of CVE-2017-14245. Notes: All CVE users should reference CVE-2017-14245 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
ALPINE-CVE-2017-17456- Updated
- 2026-11-02
OSVNo score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-14245. Reason: This candidate is a duplicate of CVE-2017-14245. Notes: All CVE users should reference CVE-2017-14245 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2017-17456- Updated
- 2026-11-02
OSVMGASA-2018-0336No score
Updated libsndfile packages fix security vulnerabilities
Updated libsndfile package fixes security vulnerabilities:
The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (CVE-2017-17456).
The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (CVE-2017-17457).
A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file (CVE-2018-13139).
- Record
MGASA-2018-0336- Updated
- 2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2024:10992-1No score
libsndfile-devel-1.0.31-2.2 on GA media
These are all security issues fixed in the libsndfile-devel-1.0.31-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10992-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2065-1No score
Security update for libsndfile
This update for libsndfile fixes the following issues:
Security issues fixed:
- CVE-2018-13139: Fix a stack-based buffer overflow in psf_memset in common.c that allows remote attackers to cause a denial of service (bsc#1100167).
- CVE-2017-17456: Prevent segmentation fault in the function d2alaw_array() that may have lead to a remote DoS (bsc#1071777)
- CVE-2017-17457: Prevent segmentation fault in the function d2ulaw_array() that may have lead to a remote DoS, a different vulnerability than CVE-2017-14246 (bsc#1071767)
- Record
SUSE-SU-2018:2065-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2074-1No score
Security update for libsndfile
This update for libsndfile fixes the following issues:
Security issues fixed:
- CVE-2018-13139: Fix a stack-based buffer overflow in psf_memset in common.c that allows remote attackers to cause a denial of service (bsc#1100167).
- CVE-2017-17456: Prevent segmentation fault in the function d2alaw_array() that may have lead to a remote DoS (bsc#1071777)
- CVE-2017-17457: Prevent segmentation fault in the function d2ulaw_array() that may have lead to a remote DoS, a different vulnerability than CVE-2017-14246 (bsc#1071767)
- Record
SUSE-SU-2018:2074-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:14008-1No score
Security update for libsndfile
This update for libsndfile fixes the following issues:
Security issues fixed:
- CVE-2017-17456: Prevent segmentation fault in the function d2alaw_array() that may have lead to a remote DoS (bsc#1071777).
- CVE-2017-17457: Prevent segmentation fault in the function d2ulaw_array() that may have lead to a remote DoS, a different vulnerability than CVE-2017-14246 (bsc#1071767).
- CVE-2018-19758: Fixed a heap-based buffer over-read at wav.c in wav_write_header that could have been used for a denial of service attack (bsc#1117954).
- Record
SUSE-SU-2019:14008-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-17456No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-14245. Reason: This candidate is a duplicate of CVE-2017-14245. Notes: All CVE users should reference CVE-2017-14245 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
UBUNTU-CVE-2017-17456- Updated
- 2026-11-02
OSVUSN-4013-1No score
libsndfile vulnerabilities
It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-4013-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
security.alpinelinux.org/vuln/CVE-2017-17456
docs.bell-sw.com/security/cves/CVE-2017-17456
advisories.mageia.org/MGASA-2018-0336.html
bugs.mageia.org/show_bug.cgi?id=23382
lists.suse.com/pipermail/sle-security-updates/2018-July/004311.html
suse.com/support/update/announcement/2018/suse-su-20182065-1
Show 36 moreShow less
bugzilla.suse.com/1071767
ubuntu.com/security/CVE-2017-17456
cve.org/CVERecord?id=CVE-2017-17456