Vulnerability Details : CVE-2014-8145
Potential exploit
Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.
Products affected by CVE-2014-8145
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*
- cpe:2.3:a:sound_exchange_project:sound_exchange:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-8145
16.28%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-8145
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2014-8145
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8145
-
http://www.mandriva.com/security/advisories?name=MDVSA-2015:015
mandriva.comBroken Link
-
https://security.gentoo.org/glsa/201612-30
SoX: User-assisted execution of arbitrary code (GLSA 201612-30) — Gentoo securityThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2019/02/msg00034.html
[SECURITY] [DLA 1687-1] sox security updateThird Party Advisory
-
http://www.securityfocus.com/bid/71774
SoX 'wav' File Multiple Heap Buffer Overflow VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.ocert.org/advisories/ocert-2014-010.html
oCERT archiveThird Party Advisory;US Government Resource
-
http://packetstormsecurity.com/files/129699/SoX-14.4.1-Heap-Buffer-Overflow.html
SoX 14.4.1 Heap Buffer Overflow ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
Oracle Bulletin Board Update - January 2015Third Party Advisory
-
http://advisories.mageia.org/MGASA-2014-0561.html
Mageia Advisory: MGASA-2014-0561 - Updated sox packages fix CVE-2014-8145Third Party Advisory
-
http://www.debian.org/security/2014/dsa-3112
Debian -- Security Information -- DSA-3112-1 soxThird Party Advisory
Jump to