CVE-2017-15372

Name	CVE-2017-15372
Description	There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1197-1, DLA-1695-1
Debian Bugs	878808

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sox (PTS)	bullseye (security), bullseye	14.4.2+git20190427-2+deb11u2	fixed
	bookworm	14.4.2+git20190427-3.5	fixed
	forky, sid, trixie	14.4.2+git20190427-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
sox	source	wheezy	14.4.0-3+deb7u2	DLA-1197-1
sox	source	jessie	14.4.1-5+deb8u2	DLA-1695-1
sox	source	stretch	14.4.1-5+deb9u2
sox	source	(unstable)	14.4.2-2		878808

https://bugzilla.redhat.com/show_bug.cgi?id=1500553
https://github.com/mansr/sox/commit/001c337552912d286ba68086ac378f6fdc1e8b50