CVE:CVE-2014-9496
CNNVD:CNNVD-201412-536
libsndfile是软件开发者Erik de Castro Lopo所研发的一个通过标准接口读写AIFF、AU和WAV等格式的音频文件的C库。
libsndfile的sd2.c文件中的‘sd2_parse_rsrc_fork’函数存在安全漏洞。攻击者可借助map偏移或rsrc标记利用该漏洞造成越边界读取。
solution:Upgrade libsndfile_project libsndfile to a higher version than 1.0.26,and avoid the version (,1.0.26); Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,15.04,15.10,and avoid the version 12.04,14.04,15.04,15.10; Upgrade oracle solaris to a higher version than 11.2,and avoid the version 11.2