{"id":"CVE-2018-17095","aliases":["AZL-45405","AZL-66252","DEBIAN-CVE-2018-17095","EUVD-2018-8875","GHSA-p9gw-6qmw-52wh","MGASA-2018-0441","OESA-2026-2353","RHSA-2020:3877","SUSE-SU-2018:3506-1","SUSE-SU-2018:3588-1","SUSE-SU-2018:3588-2","UBUNTU-CVE-2018-17095","USN-3800-1","USN-6558-1","openSUSE-SU-2024:10640-1"],"status":"published","title":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0...","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04654,"percentile":0.91802,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2018-09-16T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"audiofile","fixed_in":["0.3.6-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"audiofile","fixed_in":["0.3.6-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"audiofile","fixed_in":["0.3.6-5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"audiofile","fixed_in":["0.3.6-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"audiofile","fixed_in":["0.3.6-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"audiofile","fixed_in":["0.3.6-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"audiofile","fixed_in":["0.3.6-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"audiofile","fixed_in":["0.3.6-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"audiofile","fixed_in":["0.3.6-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"audiofile","fixed_in":["0.3.6-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"audiofile","fixed_in":["0.3.6-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"audiofile","fixed_in":["0.3.6-11.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"audiofile","fixed_in":["0.3.6-2ubuntu0.14.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"audiofile","fixed_in":["0.3.6-2ubuntu0.16.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"audiofile","fixed_in":["0.3.6-4ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.6-27"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.6-27"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-8.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-32.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-32.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-32.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-32.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-32.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"audiofile-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"audiofile-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"audiofile-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"audiofile-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"audiofile-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"audiofile-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"audiofile-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"audiofile-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.6-9.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-2ubuntu0.14.04.3"}]}],"versions":["0.3.6-2","0.3.6-2ubuntu0.14.04.1","0.3.6-2ubuntu0.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-2ubuntu0.16.04.1+esm1"}]}],"versions":["0.3.6-2","0.3.6-2ubuntu0.15.10.1","0.3.6-2ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-4ubuntu0.1~esm1"}]}],"versions":["0.3.6-4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-2ubuntu0.14.04.3"}]}],"versions":["0.3.6-2","0.3.6-2ubuntu0.14.04.1","0.3.6-2ubuntu0.14.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-2ubuntu0.14.04.3+esm1"}]}],"versions":["0.3.6-2","0.3.6-2ubuntu0.14.04.1","0.3.6-2ubuntu0.14.04.2","0.3.6-2ubuntu0.14.04.3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-2ubuntu0.16.04.1+esm1"}]}],"versions":["0.3.6-2","0.3.6-2ubuntu0.15.10.1","0.3.6-2ubuntu0.16.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-4ubuntu0.1~esm1"}]}],"versions":["0.3.6-4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-5+deb10u1build0.20.04.1"}]}],"versions":["0.3.6-5","0.3.6-5build1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-5+deb10u1build0.22.04.1"}]}],"versions":["0.3.6-5build1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"audiofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-11.13"}]}],"bundled":8}],"products":[{"vendor":"audiofile","product":"audiofile"},{"vendor":"canonical","product":"ubuntu_linux"}],"references":[{"url":"https://github.com/mpruett/audiofile/issues/50","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://usn.ubuntu.com/3800-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/mpruett/audiofile/issues/51","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17095","tags":["web","advisory"]},{"url":"https://usn.ubuntu.com/3800-1"},{"url":"https://github.com/advisories/GHSA-p9gw-6qmw-52wh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-17095","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0441.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23754","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IILVUXOJMQBFB3GUWXZZXN4PLR3PV4IO/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2353","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24599","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3877","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1600367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1631088","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3877.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-13440","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-13440","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-17095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-17095","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183506-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1111586","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17095","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183588-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183588-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-17095","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3800-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6558-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-13440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24599","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6839","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-17095","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2018-09-16T21:00:00Z","modified":"2024-08-05T10:39:59.553Z","updated_at":"2026-11-02T14:35:07.354449Z"}],"euvd":[{"id":"EUVD-2018-8875","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2018-09-16T21:00:00Z","modified":"2024-08-05T10:39:59Z","updated_at":"2026-11-03T02:39:39.763591Z"}],"ghsa":[{"id":"GHSA-p9gw-6qmw-52wh","title":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0...","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2022-05-13T01:11:43Z","modified":"2025-08-13T21:31:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:03:16.715076Z"}],"nvd":[{"id":"CVE-2018-17095","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2018-09-16T21:29:00.86Z","modified":"2026-06-17T01:45:21.25Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"AZL-45405","title":"CVE-2018-17095 affecting package audiofile 0.3.6-27","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2018-09-16T21:29:00Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"AZL-66252","title":"CVE-2018-17095 affecting package audiofile 0.3.6-27","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2018-09-16T21:29:00Z","modified":"2026-04-21T04:37:49.181665Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"CVE-2018-17095","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2018-09-16T21:29:00.86Z","modified":"2026-10-20T10:50:04.231986988Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-17095","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2018-09-16T21:29:00.86Z","modified":"2026-10-23T18:03:20.156984173Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"OESA-2026-2353","title":"audiofile security update","description":"The Audio File Library is a C-based library for reading and writing audio files in many common formats.\r\n\r\nSecurity Fix(es):\n\nThe audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert.(CVE-2018-13440)\n\nAn issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.(CVE-2018-17095)\n\nIn autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data, however, it dosn\u0026apos;t use zero bytes to truncate the data.(CVE-2022-24599)","status":"published","published":"2026-05-15T11:11:19Z","modified":"2026-08-18T01:19:54.769262484Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2020:3877","title":"Red Hat Security Advisory: audiofile security update","status":"published","published":"2024-09-16T03:37:24Z","modified":"2026-06-26T10:50:13Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2018-17095","description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","status":"published","published":"2018-09-16T00:00:00Z","modified":"2026-04-22T11:47:31.150211Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"MGASA-2018-0441","title":"Updated audiofile packages fix security vulnerabilities","description":"A NULL pointer dereference in modules/ModuleState.cpp:ModuleState::setup()\nallows for denial of service via crafted file (CVE-2018-13440).\n\nA Heap-based buffer overflow was found in Expand3To4Module::run when\nrunning sfconvert (CVE-2018-17095).\n","status":"published","published":"2018-11-11T21:09:54Z","modified":"2026-04-16T06:25:13.084890476Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10640-1","title":"audiofile-0.3.6-11.13 on GA media","description":"These are all security issues fixed in the audiofile-0.3.6-11.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:56:03.074376Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:3506-1","title":"Security update for audiofile","description":"This update for audiofile fixes the following issues:\n\n- CVE-2018-17095: A heap-based buffer overflow in Expand3To4Module::run could occurred when running sfconvert leading to crashes or code execution when handling untrusted soundfiles (bsc#1111586).\n","status":"published","published":"2018-10-26T14:12:41Z","modified":"2026-02-04T03:20:13.659531Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3588-1","title":"Security update for audiofile","description":"This update for audiofile fixes the following issues:\n\n- CVE-2018-17095: A heap-based buffer overflow in Expand3To4Module::run could occurred when running sfconvert leading to crashes or code execution when handling untrusted soundfiles (bsc#1111586).\n","status":"published","published":"2018-10-31T09:45:48Z","modified":"2026-02-04T03:48:38.633983Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3588-2","title":"Security update for audiofile","description":"This update for audiofile fixes the following issues:\n\n- CVE-2018-17095: A heap-based buffer overflow in Expand3To4Module::run could occurred when running sfconvert leading to crashes or code execution when handling untrusted soundfiles (bsc#1111586).\n","status":"published","published":"2018-12-10T08:21:56Z","modified":"2026-02-04T02:20:22.278074Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3800-1","title":"audiofile vulnerabilities","description":"It was discovered that audiofile incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2018-13440)\n\nIt was discovered that audiofile incorrectly handled certain files.\nAn attacker could possibly use this issue to  execute arbitrary code.\n(CVE-2018-17095)\n","status":"published","published":"2018-10-24T13:58:23Z","modified":"2026-04-22T09:51:51.896555Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-6558-1","title":"audiofile vulnerabilities","description":"It was discovered that audiofile could be made to dereference invalid\nmemory. If a user or an automated system were tricked into opening a\nspecially crafted file, an attacker could possibly use this issue to cause\na denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu\n18.04 LTS. (CVE-2018-13440)\n\nIt was discovered that audiofile could be made to write out of bounds. If a\nuser or an automated system were tricked into opening a specially crafted\nfile, an attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code. This issue only affected Ubuntu 16.04\nLTS and Ubuntu 18.04 LTS. (CVE-2018-17095)\n\nIt was discovered that audiofile could be made to dereference invalid\nmemory. If a user or an automated system were tricked into opening a\nspecially crafted file, an attacker could possibly use this issue to cause\na denial of service. (CVE-2019-13147)\n\nIt was discovered that audiofile could be made to leak memory. If a user or\nan automated system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2022-24599)\n","status":"published","published":"2023-12-14T16:44:57Z","modified":"2026-06-29T13:51:00.143480719Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}