| Name | CVE-2012-6303 |
| Description | Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 695614 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| snack (PTS) | bullseye | 2.2.10.20090623-dfsg-10 | fixed |
| bookworm | 2.2.10.20090624+dfsg-1 | fixed |
| sid, trixie | 2.2.10.20090624+dfsg-2 | fixed |
| wavesurfer (PTS) | bookworm, bullseye | 1.8.8p5-1.1 | fixed |
| sid, trixie | 1.8.8p5-4 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| snack | source | squeeze | 2.2.10-dfsg1-9+squeeze1 | | | |
| snack | source | (unstable) | 2.2.10-dfsg1-12.1 | low | | 695614 |
| wavesurfer | source | (unstable) | (not affected) | | | |
Notes
- wavesurfer <not-affected> (originally reported in wavesurfer, but actually a bug in libsnack, see bug #695615)
http://secunia.com/advisories/49889/
https://www.openwall.com/lists/oss-security/2012/12/10/2