CVE-2021-23172

A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2021-23172	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1975666	Issue Tracking Third Party Advisory
https://security.archlinux.org/CVE-2021-23172	Third Party Advisory
https://sourceforge.net/p/sox/bugs/350/	Exploit Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-23172	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1975666	Issue Tracking Third Party Advisory
https://security.archlinux.org/CVE-2021-23172	Third Party Advisory
https://sourceforge.net/p/sox/bugs/350/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sox_project:sox:14.4.2-7:*:*:*:*:*:*:*

History

21 Nov 2024, 05:51

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/security/cve/CVE-2021-23172 - Third Party Advisory~~	() https://access.redhat.com/security/cve/CVE-2021-23172 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=1975666 - Issue Tracking, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=1975666 - Issue Tracking, Third Party Advisory
References	~~() https://security.archlinux.org/CVE-2021-23172 - Third Party Advisory~~	() https://security.archlinux.org/CVE-2021-23172 - Third Party Advisory
References	~~() https://sourceforge.net/p/sox/bugs/350/ - Exploit, Third Party Advisory~~	() https://sourceforge.net/p/sox/bugs/350/ - Exploit, Third Party Advisory

Information

Published : 2022-08-25 20:15

Updated : 2024-11-21 05:51

NVD link : CVE-2021-23172

Mitre link : CVE-2021-23172

CVE.ORG link : CVE-2021-23172

JSON object : View

Products Affected

sox_project

sox

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-787

Out-of-bounds Write

{"id": "CVE-2021-23172", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-08-25T20:15:08.977", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2021-23172", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975666", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://security.archlinux.org/CVE-2021-23172", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://sourceforge.net/p/sox/bugs/350/", "tags": ["Exploit", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2021-23172", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1975666", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.archlinux.org/CVE-2021-23172", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://sourceforge.net/p/sox/bugs/350/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-120"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad en SoX, donde es producido un desbordamiento del b\u00fafer de la pila en la funci\u00f3n startread() del archivo hcom.c. La vulnerabilidad puede explotarse con un archivo hcomn dise\u00f1ado, que podr\u00eda causar el bloqueo de una aplicaci\u00f3n."}], "lastModified": "2024-11-21T05:51:19.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sox_project:sox:14.4.2-7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D568262D-27C8-459D-8901-95F057CCB7F5"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}