CVE-2017-12562

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/erikd/libsndfile/issues/292Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00020.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201811-23Third Party Advisory
https://github.com/erikd/libsndfile/issues/292Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00020.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201811-23Third Party Advisory

Timeline

Published: Aug 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-125636.5In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to CVE-2017-125646.5In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause CVE-2017-125656.5In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cau CVE-2017-125666.5In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMVGImage in coders/mvg.c, which allows attackers to cause CVE-2017-125679.8SQL injection exists in Quest KACE Asset Management Appliance 6.4.120822 through 7.2, Systems Management Appliance 6.4.120822 through 7.2.10 CVE-2017-125687.5Denial of Service vulnerability in Debut embedded httpd 1.20 in Brother DCP-J132W (and probably other DCP models) allows remote attackers to CVE-2017-12574.3IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on th CVE-2017-125724.8Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk CVE-2017-125738.8An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. The device has a command-injection vulnerability in the web CVE-2017-125749.8An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dangerous" was injected i CVE-2017-125757.5An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configurat CVE-2017-125767.2An issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page allows an attacker to execute arbitrary code o