CVE-2021-4156

Public on 2022-02-16
Modified on 2024-02-07
Description
An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
Severity
Medium severity
Medium
CVSS v3 Base Score
6.1
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
HAQM Linux 2 - Core libsndfile 2023-03-17 ALAS2-2023-1998 Fixed
HAQM Linux 2023 libsndfile 2023-02-17 ALAS2023-2023-028 Fixed

CVSS Scores

Score Type Score Vector
HAQM Linux CVSSv3 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
NVD CVSSv3 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
NVD CVSSv2 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P