CVE-2014-9496
CVE-2014-9496 is a low-severity vulnerability in Libsndfile Project Libsndfile with a CVSS 2.0 base score of 2.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Low (CVSS 2.0 base score 2.1)
- EPSS exploit prediction: 1% (44th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Libsndfile Project Libsndfile
- Published:
- Last modified:
Description
The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
Frequently asked questions
- What is CVE-2014-9496?
- The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
- How severe is CVE-2014-9496?
- CVE-2014-9496 has a CVSS 2.0 base score of 2.1, rated low severity.
- Is CVE-2014-9496 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-9496?
- CVE-2014-9496 primarily affects Libsndfile Project Libsndfile. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2014-9496?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-9496 published?
- CVE-2014-9496 was published on 2015-01-16 and last updated on 2026-06-17.
References
- http://advisories.mageia.org/MGASA-2015-0015.html
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00016.html
- http://secunia.com/advisories/62320
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:024
- http://www.openwall.com/lists/oss-security/2015/01/04/4
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.securityfocus.com/bid/71796
- http://www.ubuntu.com/usn/USN-2832-1
- https://github.com/erikd/libsndfile/commit/dbe14f00030af5d3577f4cabbf9861db59e9c378
- https://github.com/erikd/libsndfile/issues/93
- https://seclists.org/bugtraq/2019/Apr/23
- https://security.gentoo.org/glsa/201612-03
Affected products (9)
- cpe:2.3:a:libsndfile_project:libsndfile:*:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*
More vulnerabilities in Libsndfile Project Libsndfile
- CVE-2017-12562 — Critical (CVSS 9.8): Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote…
- CVE-2021-3246 — High (CVSS 8.8): A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary…
- CVE-2018-13139 — High (CVSS 8.8): A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial…
- CVE-2017-6892 — High (CVSS 8.8): In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an…
- CVE-2017-8361 — High (CVSS 8.8): The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service…
- CVE-2018-19662 — High (CVSS 8.1): An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that…