OPENSUSE-SU-2018:0489-1

Vulnerability from csaf_opensuse - Published: 2018-02-20 12:28 - Updated: 2026-09-20 18:45
Summary
Security update for sox
Severity
Moderate
Notes
Title of the patch: Security update for sox
Description of the patch: This update for sox fixes the following issues: * CVE-2017-11332: Fixed the startread function in wav.c, which allowed remote attackers to cause a DoS (divide-by-zero) via a crafted wav file. (boo#1081140) * CVE-2017-11358: Fixed the read_samples function in hcom.c, which allowed remote attackers to cause a DoS (invalid memory read) via a crafted hcom file. (boo#1081141) * CVE-2017-11359: Fixed the wavwritehdr function in wav.c, which allowed remote attackers to cause a DoS (divide-by-zero) when converting a a crafted snd file to a wav file. (boo#1081142) * CVE-2017-15370: Fixed a heap-based buffer overflow in the ImaExpandS function of ima_rw.c, which allowed remote attackers to cause a DoS during conversion of a crafted audio file. (boo#1063439) * CVE-2017-15371: Fixed an assertion abort in the function sox_append_comment() in formats.c, which allowed remote attackers to cause a DoS during conversion of a crafted audio file. (boo#1063450) * CVE-2017-15372: Fixed a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c, which allowed remote attackers to cause a DoS during conversion of a crafted audio file. (boo#1063456) * CVE-2017-15642: Fixed an Use-After-Free vulnerability in lsx_aiffstartread in aiff.c, which could be triggered by an attacker by providing a malformed AIFF file. (boo#1064576) * CVE-2017-18189: Fixed a NULL pointer dereference triggered by a corrupt header specifying zero channels in the startread function in xa.c, which allowed remote attackers to cause a DoS (boo#1081146).
Patchnames: openSUSE-2018-185
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2017-11332
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x —
Vendor Fix
Unresolved product id: SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2017-11358
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 12 products, the same list as for CVE-2017-11332
Threats
Impact moderate
CVE-2017-11359
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 12 products, the same list as for CVE-2017-11332
Threats
Impact moderate
CVE-2017-15370
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Recommended 12 products, the same list as for CVE-2017-11332
Threats
Impact moderate
CVE-2017-15371
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 12 products, the same list as for CVE-2017-11332
Threats
Impact moderate
CVE-2017-15372
3.3 (Low)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 12 products, the same list as for CVE-2017-11332
Threats
Impact low
CVE-2017-15642
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected products
Recommended 12 products, the same list as for CVE-2017-11332
Threats
Impact moderate
CVE-2017-18189
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 12 products, the same list as for CVE-2017-11332
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://bugzilla.suse.com/1063439 self
https://bugzilla.suse.com/1063450 self
https://bugzilla.suse.com/1063456 self
https://bugzilla.suse.com/1064576 self
https://bugzilla.suse.com/1081140 self
https://bugzilla.suse.com/1081141 self
https://bugzilla.suse.com/1081142 self
https://bugzilla.suse.com/1081146 self
https://www.suse.com/security/cve/CVE-2017-11332/ self
https://www.suse.com/security/cve/CVE-2017-11358/ self
https://www.suse.com/security/cve/CVE-2017-11359/ self
https://www.suse.com/security/cve/CVE-2017-15370/ self
https://www.suse.com/security/cve/CVE-2017-15371/ self
https://www.suse.com/security/cve/CVE-2017-15372/ self
https://www.suse.com/security/cve/CVE-2017-15642/ self
https://www.suse.com/security/cve/CVE-2017-18189/ self
https://www.suse.com/security/cve/CVE-2017-11332 external
https://bugzilla.suse.com/1081140 external
https://www.suse.com/security/cve/CVE-2017-11358 external
https://bugzilla.suse.com/1081141 external
https://www.suse.com/security/cve/CVE-2017-11359 external
https://bugzilla.suse.com/1081142 external
https://www.suse.com/security/cve/CVE-2017-15370 external
https://bugzilla.suse.com/1063439 external
https://www.suse.com/security/cve/CVE-2017-15371 external
https://bugzilla.suse.com/1063450 external
https://www.suse.com/security/cve/CVE-2017-15372 external
https://bugzilla.suse.com/1063456 external
https://www.suse.com/security/cve/CVE-2017-15642 external
https://bugzilla.suse.com/1064576 external
https://www.suse.com/security/cve/CVE-2017-18189 external
https://bugzilla.suse.com/1081146 external
https://bugzilla.suse.com/1141667 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for sox",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for sox fixes the following issues:\n\n* CVE-2017-11332: Fixed the startread function in wav.c, which allowed\n  remote attackers to cause a DoS (divide-by-zero) via a crafted wav file.\n  (boo#1081140)\n* CVE-2017-11358: Fixed the read_samples function in hcom.c, which\n  allowed remote attackers to cause a DoS (invalid memory read) via a crafted\n  hcom file. (boo#1081141)\n* CVE-2017-11359: Fixed the wavwritehdr function in wav.c, which\n  allowed remote attackers to cause a DoS (divide-by-zero) when converting a\n  a crafted snd file to a wav file. (boo#1081142)\n* CVE-2017-15370: Fixed a heap-based buffer overflow in the ImaExpandS\n  function of ima_rw.c, which allowed remote attackers to cause a DoS during\n  conversion of a crafted audio file. (boo#1063439)\n* CVE-2017-15371: Fixed an assertion abort in the function\n  sox_append_comment() in formats.c, which allowed remote attackers to cause\n  a DoS during conversion of a crafted audio file. (boo#1063450)\n* CVE-2017-15372: Fixed a stack-based buffer overflow in the\n  lsx_ms_adpcm_block_expand_i function of adpcm.c, which allowed remote\n  attackers to cause a DoS during conversion of a crafted audio file.\n  (boo#1063456)\n* CVE-2017-15642: Fixed an Use-After-Free vulnerability in\n  lsx_aiffstartread in aiff.c, which could be triggered by an attacker by\n  providing a malformed AIFF file. (boo#1064576)\n* CVE-2017-18189: Fixed a NULL pointer dereference triggered by a\n  corrupt header specifying zero channels in the startread function in\n  xa.c, which allowed remote attackers to cause a DoS (boo#1081146).\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2018-185",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2018_0489-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1063439",
        "url": "https://bugzilla.suse.com/1063439"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1063450",
        "url": "https://bugzilla.suse.com/1063450"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1063456",
        "url": "https://bugzilla.suse.com/1063456"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1064576",
        "url": "https://bugzilla.suse.com/1064576"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1081140",
        "url": "https://bugzilla.suse.com/1081140"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1081141",
        "url": "https://bugzilla.suse.com/1081141"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1081142",
        "url": "https://bugzilla.suse.com/1081142"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1081146",
        "url": "https://bugzilla.suse.com/1081146"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-11332 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-11332/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-11358 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-11358/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-11359 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-11359/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-15370 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-15370/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-15371 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-15371/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-15372 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-15372/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-15642 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-15642/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-18189 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-18189/"
      }
    ],
    "title": "Security update for sox",
    "tracking": {
      "current_release_date": "2026-09-20T18:45:19Z",
      "generator": {
        "date": "2018-02-20T12:28:13Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2018:0489-1",
      "initial_release_date": "2018-02-20T12:28:13Z",
      "revision_history": [
        {
          "date": "2018-02-20T12:28:13Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T18:45:19Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsox3-0:14.4.2-5.1.aarch64",
                "product": {
                  "name": "libsox3-0:14.4.2-5.1.aarch64",
                  "product_id": "libsox3-0:14.4.2-5.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libsox3@14.4.2-5.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "sox-0:14.4.2-5.1.aarch64",
                "product": {
                  "name": "sox-0:14.4.2-5.1.aarch64",
                  "product_id": "sox-0:14.4.2-5.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sound_exchange_project:sound_exchange:14.4.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/sox@14.4.2-5.1?arch=aarch64\u0026upstream=sox-0:14.4.2-5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "sox-devel-0:14.4.2-5.1.aarch64",
                "product": {
                  "name": "sox-devel-0:14.4.2-5.1.aarch64",
                  "product_id": "sox-devel-0:14.4.2-5.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/sox-devel@14.4.2-5.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsox3-0:14.4.2-5.1.ppc64le",
                "product": {
                  "name": "libsox3-0:14.4.2-5.1.ppc64le",
                  "product_id": "libsox3-0:14.4.2-5.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libsox3@14.4.2-5.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "sox-0:14.4.2-5.1.ppc64le",
                "product": {
                  "name": "sox-0:14.4.2-5.1.ppc64le",
                  "product_id": "sox-0:14.4.2-5.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sound_exchange_project:sound_exchange:14.4.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/sox@14.4.2-5.1?arch=ppc64le\u0026upstream=sox-0:14.4.2-5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "sox-devel-0:14.4.2-5.1.ppc64le",
                "product": {
                  "name": "sox-devel-0:14.4.2-5.1.ppc64le",
                  "product_id": "sox-devel-0:14.4.2-5.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/sox-devel@14.4.2-5.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsox3-0:14.4.2-5.1.s390x",
                "product": {
                  "name": "libsox3-0:14.4.2-5.1.s390x",
                  "product_id": "libsox3-0:14.4.2-5.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libsox3@14.4.2-5.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "sox-0:14.4.2-5.1.s390x",
                "product": {
                  "name": "sox-0:14.4.2-5.1.s390x",
                  "product_id": "sox-0:14.4.2-5.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sound_exchange_project:sound_exchange:14.4.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/sox@14.4.2-5.1?arch=s390x\u0026upstream=sox-0:14.4.2-5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "sox-devel-0:14.4.2-5.1.s390x",
                "product": {
                  "name": "sox-devel-0:14.4.2-5.1.s390x",
                  "product_id": "sox-devel-0:14.4.2-5.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/sox-devel@14.4.2-5.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsox3-0:14.4.2-5.1.x86_64",
                "product": {
                  "name": "libsox3-0:14.4.2-5.1.x86_64",
                  "product_id": "libsox3-0:14.4.2-5.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libsox3@14.4.2-5.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "sox-0:14.4.2-5.1.x86_64",
                "product": {
                  "name": "sox-0:14.4.2-5.1.x86_64",
                  "product_id": "sox-0:14.4.2-5.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sound_exchange_project:sound_exchange:14.4.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/sox@14.4.2-5.1?arch=x86_64\u0026upstream=sox-0:14.4.2-5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "sox-devel-0:14.4.2-5.1.x86_64",
                "product": {
                  "name": "sox-devel-0:14.4.2-5.1.x86_64",
                  "product_id": "sox-devel-0:14.4.2-5.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/sox-devel@14.4.2-5.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 12 SP3",
                "product": {
                  "name": "SUSE Package Hub 12 SP3",
                  "product_id": "SUSE Package Hub 12 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:12:sp3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsox3-0:14.4.2-5.1.aarch64 as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64"
        },
        "product_reference": "libsox3-0:14.4.2-5.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsox3-0:14.4.2-5.1.ppc64le as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le"
        },
        "product_reference": "libsox3-0:14.4.2-5.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsox3-0:14.4.2-5.1.s390x as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x"
        },
        "product_reference": "libsox3-0:14.4.2-5.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsox3-0:14.4.2-5.1.x86_64 as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64"
        },
        "product_reference": "libsox3-0:14.4.2-5.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sox-0:14.4.2-5.1.aarch64 as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64"
        },
        "product_reference": "sox-0:14.4.2-5.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sox-0:14.4.2-5.1.ppc64le as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le"
        },
        "product_reference": "sox-0:14.4.2-5.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sox-0:14.4.2-5.1.s390x as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x"
        },
        "product_reference": "sox-0:14.4.2-5.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sox-0:14.4.2-5.1.x86_64 as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64"
        },
        "product_reference": "sox-0:14.4.2-5.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sox-devel-0:14.4.2-5.1.aarch64 as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64"
        },
        "product_reference": "sox-devel-0:14.4.2-5.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sox-devel-0:14.4.2-5.1.ppc64le as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le"
        },
        "product_reference": "sox-devel-0:14.4.2-5.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sox-devel-0:14.4.2-5.1.s390x as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x"
        },
        "product_reference": "sox-devel-0:14.4.2-5.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sox-devel-0:14.4.2-5.1.x86_64 as component of SUSE Package Hub 12 SP3",
          "product_id": "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        },
        "product_reference": "sox-devel-0:14.4.2-5.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 12 SP3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-11332",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-11332"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted wav file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-11332",
          "url": "https://www.suse.com/security/cve/CVE-2017-11332"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1081140 for CVE-2017-11332",
          "url": "https://bugzilla.suse.com/1081140"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-20T12:28:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-11332"
    },
    {
      "cve": "CVE-2017-11358",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-11358"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The read_samples function in hcom.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted hcom file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-11358",
          "url": "https://www.suse.com/security/cve/CVE-2017-11358"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1081141 for CVE-2017-11358",
          "url": "https://bugzilla.suse.com/1081141"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-20T12:28:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-11358"
    },
    {
      "cve": "CVE-2017-11359",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-11359"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The wavwritehdr function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted snd file, during conversion to a wav file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-11359",
          "url": "https://www.suse.com/security/cve/CVE-2017-11359"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1081142 for CVE-2017-11359",
          "url": "https://bugzilla.suse.com/1081142"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-20T12:28:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-11359"
    },
    {
      "cve": "CVE-2017-15370",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-15370"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There is a heap-based buffer overflow in the ImaExpandS function of ima_rw.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-15370",
          "url": "https://www.suse.com/security/cve/CVE-2017-15370"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063439 for CVE-2017-15370",
          "url": "https://bugzilla.suse.com/1063439"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-20T12:28:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-15370"
    },
    {
      "cve": "CVE-2017-15371",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-15371"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There is a reachable assertion abort in the function sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-15371",
          "url": "https://www.suse.com/security/cve/CVE-2017-15371"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063450 for CVE-2017-15371",
          "url": "https://bugzilla.suse.com/1063450"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-20T12:28:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-15371"
    },
    {
      "cve": "CVE-2017-15372",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-15372"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-15372",
          "url": "https://www.suse.com/security/cve/CVE-2017-15372"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063456 for CVE-2017-15372",
          "url": "https://bugzilla.suse.com/1063456"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-20T12:28:13Z",
          "details": "low"
        }
      ],
      "title": "CVE-2017-15372"
    },
    {
      "cve": "CVE-2017-15642",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-15642"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In lsx_aiffstartread in aiff.c in Sound eXchange (SoX) 14.4.2, there is a Use-After-Free vulnerability triggered by supplying a malformed AIFF file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-15642",
          "url": "https://www.suse.com/security/cve/CVE-2017-15642"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1064576 for CVE-2017-15642",
          "url": "https://bugzilla.suse.com/1064576"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-20T12:28:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-15642"
    },
    {
      "cve": "CVE-2017-18189",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-18189"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
          "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-18189",
          "url": "https://www.suse.com/security/cve/CVE-2017-18189"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1081146 for CVE-2017-18189",
          "url": "https://bugzilla.suse.com/1081146"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141667 for CVE-2017-18189",
          "url": "https://bugzilla.suse.com/1141667"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:libsox3-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-0:14.4.2-5.1.x86_64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.aarch64",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.ppc64le",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.s390x",
            "SUSE Package Hub 12 SP3:sox-devel-0:14.4.2-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-20T12:28:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-18189"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.