CVE-2012-6303

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00034.htmlThird Party Advisory
http://secunia.com/advisories/49889Vendor Advisory
http://security.gentoo.org/glsa/glsa-201309-04.xmlThird Party Advisory
http://www.exploit-db.com/exploits/19772Exploit, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:126Broken Link
http://www.openwall.com/lists/oss-security/2012/12/10/2Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00034.htmlThird Party Advisory
http://secunia.com/advisories/49889Vendor Advisory
http://security.gentoo.org/glsa/glsa-201309-04.xmlThird Party Advisory
http://www.exploit-db.com/exploits/19772Exploit, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:126Broken Link
http://www.openwall.com/lists/oss-security/2012/12/10/2Mailing List, Third Party Advisory

Timeline

Published: Oct 28, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-63069.8A vulnerability exists in HCView (aka Hardcoreview) 1.4 due to a write access violation with a GIF file.CVE-2012-63078.8A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitr CVE-2012-63097.5A vulnerability exists in Arctic Torrent 1.4 via unspecified vectors in .torrent file handling, which could let a malicious user cause a Den CVE-2012-63124.3Cross-site scripting (XSS) vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script CVE-2012-63135.0simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information v CVE-2012-63145.0Citrix XenDesktop Virtual Desktop Agent (VDA) 5.6.x before 5.6.200, when making changes to the server-side policy that control USB redirecti CVE-2012-63164.3Multiple cross-site scripting (XSS) vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier CVE-2012-63244.0Directory traversal vulnerability in VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 and 5.1 before Patch 1 allows remote authent CVE-2012-63254.0VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 does not properly parse XML documents, which allows remote authenticated users to CVE-2012-63267.8VMware vCenter Server 4.1 before Update 3 and 5.0 before Update 2, and vCSA 5.0 before Update 2, allows remote attackers to cause a denial o CVE-2012-63297.5The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and f CVE-2012-63305.0The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to c