Cloudanix VulnDB

CVE-2024-50612

None

CVSS

—

EPSS

0.3%

Published

Oct 27, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in audio file handling can make programs crash or leak data when they open certain sound files, so updating the software fixes the problem.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in ogg_vorbis.c triggered by vorbis_analysis_wrote, allowing memory corruption in the libsndfile library used by affected packages.

Why it matters to the business

Potential application crashes or information disclosure when processing malformed OGG Vorbis audio files, leading to service disruption and possible data exposure in image and media processing workflows.

How an attack unfolds

An attacker crafts a malicious OGG Vorbis file that triggers the out-of-bounds read during analysis, causing the application to access invalid memory which may result in a crash or leak of adjacent memory contents.

How to fix it

Upgrade python-Pillow packages to version 9.5.0-150400.5.9.1 or later on all listed SUSE platforms: SUSE Linux Enterprise Module for Python 3 15 SP5, openSUSE Leap 15.5, SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS, SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, SUSE Linux Enterprise Server 15 SP4-LTSS, and SUSE Linux Enterprise Server for SAP Applications 15 SP4.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases listed for each SUSE distribution and test audio file processing with known malformed OGG Vorbis samples in a controlled environment.

Typical attack path

  1. Identify a target application that processes OGG Vorbis audio via the vulnerable library
  2. Craft and deliver a specially malformed OGG Vorbis file to the target
  3. Trigger file processing to invoke vorbis_analysis_wrote
  4. Observe crash or extract leaked memory contents

How to detect it

Review application logs and crash reports for segmentation faults or memory access errors during OGG Vorbis processing; look for unexpected file handling activity in media pipelines.

What your security team should do

  • Prioritize patching all affected SUSE python-Pillow installations to the specified fixed versions
  • Restrict processing of untrusted audio files until patches are applied
  • Monitor EPSS and KEV status for any future changes indicating increased risk

The record

libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 libsndfile 0 1.0.28-16.el8_10
AlmaLinux:8 libsndfile-devel 0 1.0.28-16.el8_10
AlmaLinux:8 libsndfile-utils 0 1.0.28-16.el8_10
AlmaLinux:9 libsndfile 0 1.0.31-8.el9_5.2
AlmaLinux:9 libsndfile-devel 0 1.0.31-8.el9_5.2
AlmaLinux:9 libsndfile-utils 0 1.0.31-8.el9_5.2
Alpine:v3.18 libsndfile 0 1.2.2-r1
Alpine:v3.19 libsndfile 0 1.2.2-r1
Alpine:v3.20 libsndfile 0 1.2.2-r1
Alpine:v3.21 libsndfile 0 1.2.2-r2
Alpine:v3.22 libsndfile 0 1.2.2-r2
Debian:11 libsndfile 0 No fix
Debian:12 libsndfile 0 No fix
Debian:13 libsndfile 0 No fix
Debian:14 libsndfile 0 1.2.2-2
Mageia:9 libsndfile 0 1.2.0-3.2.mga9
Red Hat:enterprise_linux:8::appstream libsndfile 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::appstream libsndfile-debuginfo 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::appstream libsndfile-debugsource 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::appstream libsndfile-devel 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::appstream libsndfile-utils 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::appstream libsndfile-utils-debuginfo 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::crb libsndfile 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::crb libsndfile-debuginfo 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::crb libsndfile-debugsource 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::crb libsndfile-devel 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::crb libsndfile-utils 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:8::crb libsndfile-utils-debuginfo 0 0:1.0.28-16.el8_10
Red Hat:enterprise_linux:9::appstream libsndfile 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::appstream libsndfile-debuginfo 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::appstream libsndfile-debugsource 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::appstream libsndfile-devel 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::appstream libsndfile-utils 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::appstream libsndfile-utils-debuginfo 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::crb libsndfile 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::crb libsndfile-debuginfo 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::crb libsndfile-debugsource 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::crb libsndfile-devel 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::crb libsndfile-utils 0 0:1.0.31-8.el9_5.2
Red Hat:enterprise_linux:9::crb libsndfile-utils-debuginfo 0 0:1.0.31-8.el9_5.2
Red Hat:rhel_eus:9.4::appstream libsndfile 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::appstream libsndfile-debuginfo 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::appstream libsndfile-debugsource 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::appstream libsndfile-devel 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::appstream libsndfile-utils 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::appstream libsndfile-utils-debuginfo 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::crb libsndfile 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::crb libsndfile-debuginfo 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::crb libsndfile-debugsource 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::crb libsndfile-devel 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::crb libsndfile-utils 0 0:1.0.31-8.el9_4.1
Red Hat:rhel_eus:9.4::crb libsndfile-utils-debuginfo 0 0:1.0.31-8.el9_4.1
Rocky Linux:9 libsndfile 0 0:1.0.31-8.el9_5.2
Ubuntu:20.04:LTS libsndfile 0 No fix
Ubuntu:20.04:LTS libsndfile 0 1.0.28-7ubuntu0.3
Ubuntu:22.04:LTS libsndfile 0 No fix
Ubuntu:22.04:LTS libsndfile 0 1.0.31-2ubuntu0.2
Ubuntu:24.04:LTS libsndfile 0 No fix
Ubuntu:24.04:LTS libsndfile 0 1.2.2-1ubuntu5.24.04.1
Ubuntu:24.10 libsndfile 0 No fix
Ubuntu:Pro:14.04:LTS libsndfile 0 No fix
Ubuntu:Pro:14.04:LTS libsndfile 0 1.0.25-7ubuntu2.2+esm4
Ubuntu:Pro:16.04:LTS libsndfile 0 No fix
Ubuntu:Pro:16.04:LTS libsndfile 0 1.0.25-10ubuntu0.16.04.3+esm4
Ubuntu:Pro:18.04:LTS libsndfile 0 No fix
Ubuntu:Pro:18.04:LTS libsndfile 0 1.0.28-4ubuntu0.18.04.2+esm2
openSUSE:Tumbleweed libsndfile 0 1.2.2-3.1

Related vulnerabilities