CVE-2021-3643 Information disclosure in sox
A global buffer overflow in the SoX library allows attackers to disclose sensitive information by providing a malicious audio file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3643?
CVE-2021-3643 is a critical vulnerability in sox, published on 2 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information.
Which versions are affected by CVE-2021-3643?
It affects 1 product.
Products include Sound Exchange Project Sound Exchange.
How do I fix CVE-2021-3643?
Upgrade to a fixed version.
Is CVE-2021-3643 being exploited?
There is no known exploitation of CVE-2021-3643 in the wild and no public exploit code.
Other vulnerabilities in sox
Sources
Also known as DEBIAN-CVE-2021-3643, GHSA-6537-hg9g-m5mp, UBUNTU-CVE-2021-3643.