PatchTheCVEsound exchange vulnerabilities and fixes
Recent CVEs affecting sound exchange, with upgrade or downgrade steps. 12 tracked.
Also searched as: soundexchange.
sound exchange has 12 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2023-07-10. Highest priority: CVE-2021-40426 (score 56/100).
- CVE-2023-34432 HIGH 7.8 UPGRADE DOWNGRADE A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:1
- CVE-2023-34318 HIGH 7.8 DOWNGRADE DOWNGRADE A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41
- CVE-2023-32627 MEDIUM 6.2 DOWNGRADE DOWNGRADE A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:1
- CVE-2023-26590 MEDIUM 6.2 DOWNGRADE DOWNGRADE A floating point exception vulnerability was found in sox, in the lsx_aiffstartwrite function at sox/src/aiff.
- CVE-2022-31651 MEDIUM 5.5 DOWNGRADE In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.
- CVE-2022-31650 MEDIUM 5.5 DOWNGRADE In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
- CVE-2021-40426 HIGH 8.8 DOWNGRADE A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange
- CVE-2021-3643 CRITICAL 9.1 DOWNGRADE A flaw was found in sox 14.4.1
- CVE-2021-33844 MEDIUM 5.5 DOWNGRADE A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file
- CVE-2021-23210 MEDIUM 5.5 DOWNGRADE A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c fil
- CVE-2021-23172 MEDIUM 5.5 DOWNGRADE A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file
- CVE-2021-23159 MEDIUM 5.5 DOWNGRADE A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_
FAQ
How do I fix sound exchange vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sound exchange being exploited right now?
None of the tracked sound exchange CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sound exchange CVE should I patch first?
CVE-2021-40426 currently ranks highest (56/100): A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange.