CVE-2024-50613

What it actually does

Reachable assertion in mpeg_l3_encode.c mpeg_l3_encoder_close leads to process termination and application exit.

Why it matters to the business

Unexpected downtime and service interruption on affected Tomcat instances until the process is restarted, with low but present exploitation likelihood.

How an attack unfolds

An attacker supplies specially crafted input that reaches the assertion in the MPEG layer-3 encoder close routine, forcing the hosting application to terminate.

How to fix it

Upgrade tomcat packages on SUSE Linux Enterprise Server 12 SP5 and SUSE Linux Enterprise Server for SAP Applications 12 SP5 to version 9.0.36-3.118.1 or later.

How to confirm the fix worked

Verify installed tomcat package versions match or exceed the fixed releases and confirm absence of the assertion in mpeg_l3_encode.c after restart.

Typical attack path

1. Locate a Tomcat instance using the vulnerable libsndfile library
2. Submit input that exercises MPEG layer-3 encoding close path
3. Trigger the reachable assertion to cause process exit

How to detect it

Review application and system logs for abrupt process exits or assertion failures involving mpeg_l3_encode.c or libsndfile on Tomcat hosts.

What your security team should do

• Apply the listed tomcat package updates on all SUSE 12 SP5 systems
• Prioritize systems exposed to untrusted audio processing workloads
• Monitor for application crashes after patching to confirm stability