CVE-2019-8356

NameCVE-2019-8356
DescriptionAn issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs927906

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
sox (PTS)jessie14.4.1-5vulnerable
jessie (security)14.4.1-5+deb8u3vulnerable
stretch14.4.1-5+deb9u1vulnerable
buster, sid14.4.2+git20190427-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
soxsource(unstable)14.4.2+git20190427-1medium927906

Notes

https://sourceforge.net/p/sox/bugs/321
https://sourceforge.net/p/sox/code/ci/b7883ae1398499daaa926ae6621f088f0f531ed8/

Search for package or bug name: Reporting problems