{"id":"CVE-2021-4156","aliases":["ALSA-2022:1968","BELL-CVE-2021-4156","CLSA-2026-1788170819","DEBIAN-CVE-2021-4156","DLA-3058-1","DLA-3126-1","DLA-4402-1","EUVD-2021-34024","GHSA-vvgm-gfhp-rj9x","OESA-2022-1680","RHSA-2022:1968","RLSA-2022:1968","SUSE-SU-2022:0034-1","SUSE-SU-2022:0052-1","SUSE-SU-2022:0052-2","SUSE-SU-2022:14872-1","UBUNTU-CVE-2021-4156","USN-5409-1","USN-7273-1","openSUSE-SU-2022:0052-1","openSUSE-SU-2024:11705-1"],"status":"published","title":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is...","description":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01754,"percentile":0.78081,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-01-05T16:20:52Z","modified":"2026-10-29T11:01:19Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"libsndfile","fixed_in":["1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libsndfile-devel","fixed_in":["1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsndfile","fixed_in":["1.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsndfile","fixed_in":["1.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsndfile","fixed_in":["1.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libsndfile","fixed_in":["1.0.28-6+deb10u2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libsndfile","fixed_in":["1.0.31-2+deb11u2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libsndfile","fixed_in":["1.0.28-20.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"libsndfile","fixed_in":["1.0.28-20.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"libsndfile","fixed_in":["1.0.31-2.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libsndfile","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libsndfile-debuginfo","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libsndfile-debugsource","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libsndfile-utils-debuginfo","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libsndfile-debuginfo","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libsndfile-debugsource","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libsndfile-devel","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libsndfile-utils-debuginfo","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libsndfile","fixed_in":["0:1.0.28-12.el8"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libsndfile","fixed_in":["1.0.25-36.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libsndfile","fixed_in":["1.0.20-2.19.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"libsndfile","fixed_in":["1.0.20-2.19.18.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsndfile","fixed_in":["1.0.25-7ubuntu2.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsndfile","fixed_in":["1.0.25-10ubuntu0.16.04.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsndfile","fixed_in":["1.0.28-4ubuntu0.18.04.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libsndfile","fixed_in":["1.0.28-7ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libsndfile","fixed_in":["1.0.31-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libsndfile","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libsndfile-progs","fixed_in":["1.0.28-5.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libsndfile","fixed_in":["1.0.31-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libsndfile-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libsndfile1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-4ubuntu0.18.04.2+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libsndfile1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-4ubuntu0.18.04.2+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"sndfile-programs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-4ubuntu0.18.04.2+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.27-3+deb9u3"}]}],"versions":["1.0.27-3","1.0.27-3+deb9u1","1.0.27-3+deb9u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-6+deb10u2"}]}],"versions":["1.0.28-6","1.0.28-6+deb10u1"]},{"source":"osv","ecosystem":"Debian:11","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2+deb11u2"}]}],"versions":["1.0.31-2","1.0.31-2+deb11u1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-20.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-20.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libsndfile-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libsndfile-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libsndfile-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libsndfile-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libsndfile-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libsndfile-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libsndfile-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.28-12.el8"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-36.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-2.19.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-2.19.18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-7ubuntu2.2+esm4"}]}],"versions":["1.0.25-7ubuntu1","1.0.25-7ubuntu2","1.0.25-7ubuntu2.1","1.0.25-7ubuntu2.2","1.0.25-7ubuntu2.2+esm1","1.0.25-7ubuntu2.2+esm2","1.0.25-7ubuntu2.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-10ubuntu0.16.04.3+esm2"}]}],"versions":["1.0.25-9.1","1.0.25-10","1.0.25-10ubuntu0.16.04.1","1.0.25-10ubuntu0.16.04.2","1.0.25-10ubuntu0.16.04.3","1.0.25-10ubuntu0.16.04.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-4ubuntu0.18.04.2+esm2"}]}],"versions":["1.0.28-4","1.0.28-4ubuntu0.18.04.1","1.0.28-4ubuntu0.18.04.2","1.0.28-4ubuntu0.18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-7ubuntu0.3"}]}],"versions":["1.0.28-6","1.0.28-7","1.0.28-7ubuntu0.1","1.0.28-7ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2ubuntu0.2"}]}],"versions":["1.0.31-2","1.0.31-2build1","1.0.31-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-10ubuntu0.16.04.3+esm2"}]}],"versions":["1.0.25-9.1","1.0.25-10","1.0.25-10ubuntu0.16.04.1","1.0.25-10ubuntu0.16.04.2","1.0.25-10ubuntu0.16.04.3","1.0.25-10ubuntu0.16.04.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-7ubuntu2.2+esm4"}]}],"versions":["1.0.25-7ubuntu1","1.0.25-7ubuntu2","1.0.25-7ubuntu2.1","1.0.25-7ubuntu2.2","1.0.25-7ubuntu2.2+esm1","1.0.25-7ubuntu2.2+esm2","1.0.25-7ubuntu2.2+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-4ubuntu0.18.04.2+esm2"}]}],"versions":["1.0.28-4","1.0.28-4ubuntu0.18.04.1","1.0.28-4ubuntu0.18.04.2","1.0.28-4ubuntu0.18.04.2+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-7ubuntu0.3"}]}],"versions":["1.0.28-6","1.0.28-7","1.0.28-7ubuntu0.1","1.0.28-7ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2ubuntu0.2"}]}],"versions":["1.0.31-2","1.0.31-2build1","1.0.31-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libsndfile-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-5.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-3.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libsndfile_project","product":"libsndfile"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027690","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/libsndfile/libsndfile/pull/732/commits/4c30646abf7834e406f7e2429c70bc254e18beab","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/libsndfile/libsndfile/issues/731","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00020.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00036.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202309-11","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/12/msg00013.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4156","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vvgm-gfhp-rj9x"},{"url":"https://errata.almalinux.org/8/ALSA-2022-1968.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-4156","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-4156","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788170819.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52194","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4156","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1680","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1968","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1968.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4156","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4156","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1968","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220034-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194006","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4156","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220052-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220052-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214872-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-4156","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5409-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7273-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-50612","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DAZJOOODJLFD53X2AQIEWTT3MS53WDSD/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-4156","description":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.","status":"published","published":"2022-03-23T00:00:00Z","modified":"2025-12-11T12:06:14.134Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:33:08.045407Z"}],"euvd":[{"id":"EUVD-2021-34024","description":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.","status":"published","published":"2022-03-23T00:00:00Z","modified":"2025-12-11T12:06:14Z","updated_at":"2026-11-02T19:49:06.661228Z"}],"ghsa":[{"id":"GHSA-vvgm-gfhp-rj9x","title":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is...","description":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.","status":"published","published":"2022-03-24T00:00:17Z","modified":"2025-12-11T15:30:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:05:09.214908Z"}],"nvd":[{"id":"CVE-2021-4156","description":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.","status":"published","published":"2022-03-23T20:15:10.097Z","modified":"2026-06-17T04:19:07.763Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:05.581807Z"}],"osv":[{"id":"BELL-CVE-2021-4156","title":"CVE-2021-4156 does not affect BellSoft software","status":"withdrawn","published":"2022-03-23T20:15:00Z","modified":"2026-01-26T09:47:09.394799Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-4156","description":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.","status":"published","published":"2022-03-23T20:15:10.097Z","modified":"2026-03-15T22:42:50.475726Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-4156","description":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.","status":"published","published":"2022-03-23T20:15:10.097Z","modified":"2026-10-23T18:04:15.478223136Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2022-1680","title":"libsndfile security update","description":"Libsndfile is a C library for reading and writing files containing sampled sound such as MS Windows WAV and the Apple/SGI AIFF format through one standard library interface.\r\n\r\nSecurity Fix(es):\r\n\r\nAn out-of-bounds read flaw was found in libsndfile\u0026apos;s FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.(CVE-2021-4156)","status":"published","published":"2022-05-28T11:04:57Z","modified":"2026-08-18T01:16:38.35574428Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:1968","title":"Red Hat Security Advisory: libsndfile security update","status":"published","published":"2024-09-16T07:32:29Z","modified":"2026-06-26T12:21:17.433629794Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1968","title":"Moderate: libsndfile security update","description":"libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. \n\nSecurity Fix(es):\n\n* libsndfile: heap out-of-bounds read in src/flac.c in flac_buffer_copy (CVE-2021-4156)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:10:12Z","modified":"2026-02-05T14:00:10.993477Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-4156","description":"An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.","status":"published","published":"2022-03-23T20:15:00Z","modified":"2026-04-22T13:01:28.294561Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"ALSA-2022:1968","title":"Moderate: libsndfile security update","description":"libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. \n\nSecurity Fix(es):\n\n* libsndfile: heap out-of-bounds read in src/flac.c in flac_buffer_copy (CVE-2021-4156)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:10:12Z","modified":"2026-10-29T11:01:19.031233375Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1788170819","title":"Fix CVE(s): CVE-2021-4156, CVE-2022-33065, CVE-2025-52194","description":"   * SECURITY UPDATE: multiple signed integer overflows in the AU, MAT4/MAT5,\n     AVR, SDS, AIFF, IRCAM, RF64, PCM and IMA-ADPCM header parsers allow\n     denial of service via a crafted file (ELSCVE-171688)\n     - debian/patches/CVE-2022-33065/CVE-2022-33065-{1..8,11..13}.patch:\n       widen the overflowing data_end, blockwidth and sample-count\n       calculations to sf_count_t in src/au.c, src/mat4.c, src/mat5.c,\n       src/avr.c, src/sds.c, src/aiff.c, src/ircam.c, src/common.h,\n       src/common.c, src/pcm.c, src/rf64.c and src/ima_adpcm.c. Byte-identical\n       to Ubuntu's own patches as shipped in the public focal security source\n       1.0.28-7ubuntu0.3 (same upstream 1.0.28, same 13-patch prefix); the\n       bionic +esm1 artifact itself is Ubuntu Pro-gated. Note that Ubuntu's\n       CVE-2022-33065-13.patch is a squash of three upstream commits rather\n       than the single one its header names: 3970faeb (IMA ADPCM nibble\n       sizing) and 7e6cc7cb (stepindx initialisation) are prerequisites that\n       1.0.28 predates, alongside the cited 9f097e49 which carries the\n       CVE-2022-33065 fix proper; all three are credited in that patch's\n       provenance note.\n     - CVE-2022-33065\n   * SECURITY UPDATE: out-of-bounds read in the FLAC decoder when a frame\n     fails to decode and the stale frame pointer is reused (ELSCVE-171682)\n     - debian/patches/CVE-2021-4156.patch: NULL pflac-\u003eframe when\n       FLAC__stream_decoder_process_single() fails in flac_read_loop() in\n       src/flac.c. Byte-identical to Ubuntu's own patch as shipped in the\n       public focal security source 1.0.28-7ubuntu0.3; upstream commit\n       ced91d7b971be6173b604154c39279ce90ad87cc.\n     - CVE-2021-4156\n   * SECURITY UPDATE: undefined float-to-int conversion of the IRCAM header\n     sample rate on out-of-range or non-finite values (ELSCVE-171686)\n     - debian/patches/CVE-2025-52194.patch: convert the file-supplied sample\n       rate with lrintf() instead of a bare (int) cast in ircam_read_header()\n       in src/ircam.c, and include \u003cmath.h\u003e. Backport of upstream commit\n       7ff854d1e0bd9a751a9ff52ed980c62afced91fe, adapted because 1.0.28 has\n       no psf_lrintf() helper; src/mat4.c already uses lrint() for the same\n       purpose in this tree.\n     - CVE-2025-52194","status":"published","published":"2026-08-31T10:07:11Z","modified":"2026-10-26T09:32:04.278067553Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-3058-1","title":"libsndfile - security update","status":"published","published":"2022-06-26T00:00:00Z","modified":"2026-03-09T01:19:18.851722Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3126-1","title":"libsndfile - security update","status":"published","published":"2022-09-30T00:00:00Z","modified":"2026-03-09T01:18:46.030601Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-4402-1","title":"libsndfile - security update","status":"published","published":"2025-12-11T00:00:00Z","modified":"2025-12-11T12:29:46.497933Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"openSUSE-SU-2022:0052-1","title":"Security update for libsndfile","description":"This update for libsndfile fixes the following issues:\n\n- CVE-2021-4156: Fixed heap buffer overflow in flac_buffer_copy that \ncould potentially lead to heap exploitation (bsc#1194006).\n","status":"published","published":"2022-01-11T09:14:57Z","modified":"2026-02-04T03:41:00.468076Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11705-1","title":"libsndfile-devel-1.0.31-3.1 on GA media","description":"These are all security issues fixed in the libsndfile-devel-1.0.31-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:30.979278Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2022:0034-1","title":"Security update for libsndfile","description":"This update for libsndfile fixes the following issues:\n\n- CVE-2021-4156: Fixed heap buffer overflow in flac_buffer_copy that \ncould potentially lead to heap exploitation (bsc#1194006).\n","status":"published","published":"2022-01-05T16:22:27Z","modified":"2026-02-04T02:13:10.636952Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0052-1","title":"Security update for libsndfile","description":"This update for libsndfile fixes the following issues:\n\n- CVE-2021-4156: Fixed heap buffer overflow in flac_buffer_copy that \ncould potentially lead to heap exploitation (bsc#1194006).\n","status":"published","published":"2022-01-11T09:16:03Z","modified":"2026-02-04T03:27:36.113665Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0052-2","title":"Security update for libsndfile","description":"This update for libsndfile fixes the following issues:\n\n- CVE-2021-4156: Fixed heap buffer overflow in flac_buffer_copy that \ncould potentially lead to heap exploitation (bsc#1194006).\n","status":"published","published":"2022-02-17T19:18:09Z","modified":"2025-05-02T04:10:52.940848Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:14872-1","title":"Security update for libsndfile","description":"This update for libsndfile fixes the following issues:\n\n- CVE-2021-4156: Fixed heap buffer overflow in flac_buffer_copy that\ncould potentially lead to heap exploitation (bsc#1194006).\n","status":"published","published":"2022-01-05T16:20:52Z","modified":"2026-02-04T03:53:57.232313Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5409-1","title":"libsndfile vulnerability","description":"It was discovered that libsndfile was incorrectly performing memory\nmanagement operations and incorrectly using buffers when executing\nits FLAC codec. If a user or automated system were tricked into\nprocessing a specially crafted sound file, an attacker could\npossibly use this issue to cause a denial of service or obtain\nsensitive information.\n","status":"published","published":"2022-05-10T18:49:47Z","modified":"2026-06-25T13:31:10.176255938Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-7273-1","title":"libsndfile vulnerabilities","description":"It was discovered that libsndfile incorrectly handled memory when executing\nits FLAC codec. If a user or automated system were tricked into processing\na specially crafted sound file, an attacker could possibly use this issue\nto cause a denial of service or obtain sensitive information.\n(CVE-2021-4156)\n\nIt was discovered that libsndfile incorrectly handled certain malformed\nOggVorbis files. An attacker could possibly use this issue to cause\nlibsndfile to crash, resulting in a denial of service. (CVE-2024-50612)\n","status":"published","published":"2025-02-18T16:37:46Z","modified":"2026-04-22T10:55:30.693392Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}