CVE-2021-23172

Katalog CVE

CVSS 5.5 · Medium EPSS 0,45%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada sound exchange project sound exchange. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash.

Rincian

Terbit di NVD

25 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2021-23172 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1975666 issue tracking · advisory pihak ketiga
• https://security.archlinux.org/CVE-2021-23172 advisory pihak ketiga
• https://sourceforge.net/p/sox/bugs/350/ exploit · advisory pihak ketiga