Vulnerability Name:

CVE-2021-3246 (CCN-205960)

Assigned:2021-01-15
Published:2021-01-15
Updated:2021-09-21
Summary:A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-787
CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-3246

Source: XF
Type: UNKNOWN
libsndfile-cve20213246-bo(205960)

Source: CCN
Type: libsndfile GIT Repository
heap-buffer-overflow in in msadpcm_decode_block #687

Source: MISC
Type: Exploit, Patch, Third Party Advisory
https://github.com/libsndfile/libsndfile/issues/687

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210729 [SECURITY] [DLA 2722-1] libsndfile security update

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-e2dc109b4c

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-8fef82e363

Source: DEBIAN
Type: Third Party Advisory
DSA-4947

Source: CCN
Type: Mend Vulnerability Database
CVE-2021-3246

Vulnerable Configuration:Configuration 1:
  • cpe:/a:libsndfile_project:libsndfile:1.0.30:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:libsndfile_project:libsndfile:1.0.30:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7434
    P
    		apache2-2.4.51-150400.6.11.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7668
    P
    		libsndfile-devel-1.0.28-150000.5.17.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7478
    P
    		db48-utils-4.8.30-150000.7.6.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:51934
    P
    		Security update for python3 (Important)
    2022-10-06
    oval:org.opensuse.security:def:754
    P
    		Security update for nodejs16 (Moderate)
    2022-09-12
    oval:org.opensuse.security:def:6134
    P
    		Security update for ncurses (Moderate)
    2022-08-09
    oval:org.opensuse.security:def:3655
    P
    		Security update for mozilla-nss (Important)
    2022-07-29
    oval:org.opensuse.security:def:95354
    P
    		Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP4) (Important)
    2022-07-05
    oval:org.opensuse.security:def:3077
    P
    		gdm-3.10.0.1-54.6.3 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3467
    P
    		cvs-1.12.12-182.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94707
    P
    		libsndfile-devel-1.0.28-5.15.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94579
    P
    		hivex-devel-1.3.21-150400.2.10 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:112833
    P
    		libsndfile-devel-1.0.31-2.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:100025
    P
    		 (Moderate)
    2021-12-06
    oval:org.opensuse.security:def:93116
    P
    		 (Moderate)
    2021-12-06
    oval:org.opensuse.security:def:93269
    P
    		 (Moderate)
    2021-10-27
    oval:org.opensuse.security:def:102067
    P
    		Security update for ffmpeg (Moderate)
    2021-10-26
    oval:org.opensuse.security:def:106298
    P
    		libsndfile-devel-1.0.31-2.2 on GA media (Moderate)
    2021-10-01
    oval:com.redhat.rhsa:def:20213295
    P
    		RHSA-2021:3295: libsndfile security update (Important)
    2021-08-30
    oval:com.redhat.rhsa:def:20213253
    P
    		RHSA-2021:3253: libsndfile security update (Important)
    2021-08-24
    oval:org.opensuse.security:def:111012
    P
    		Security update for libsndfile (Critical)
    2021-08-19
    oval:org.opensuse.security:def:95859
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:108733
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:73678
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:92566
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:8819
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:69707
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:101292
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:64556
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:118323
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:111667
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:9766
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:91980
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:102057
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:68523
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:99516
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:109238
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:73866
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:92765
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:9014
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:69906
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:64744
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:98930
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:10131
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:92175
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:68567
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:99715
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:75963
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:92963
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:9377
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:70271
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:102572
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:5806
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:66895
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:99125
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:107958
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:10317
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:92367
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:1477
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:8633
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:69517
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:76291
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:117472
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:9567
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:70457
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:101485
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:67223
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:99317
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:32973
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:58796
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:87437
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:23946
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:51629
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:127145
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:89430
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:30228
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:56051
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:84188
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:33694
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:59517
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:88166
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:26099
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:82611
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:31241
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:57064
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:85705
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:125579
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:33952
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:59775
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:88480
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:29404
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:55227
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:83315
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:5086
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:31662
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:57485
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:86126
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:23641
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:126748
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:34498
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:60321
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:89172
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:30108
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:55931
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:83435
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:40497
    P
    		Security update for libsndfile (Critical)
    2021-07-27
    oval:org.opensuse.security:def:43575
    P
    		Security update for libsndfile (Critical)
    2021-07-27
    oval:org.opensuse.security:def:41507
    P
    		Security update for libsndfile (Critical)
    2021-07-27
    oval:org.opensuse.security:def:44927
    P
    		Security update for libsndfile (Critical)
    2021-07-27
    oval:org.opensuse.security:def:38206
    P
    		Security update for libsndfile (Critical)
    2021-07-27
    oval:org.opensuse.security:def:45937
    P
    		Security update for libsndfile (Critical)
    2021-07-27
    oval:org.opensuse.security:def:39145
    P
    		Security update for libsndfile (Critical)
    2021-07-27
    BACK
    libsndfile_project libsndfile 1.0.30
    fedoraproject fedora 33
    fedoraproject fedora 34
    debian debian linux 9.0
    debian debian linux 10.0
    libsndfile_project libsndfile 1.0.30