CVE-2017-9260

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The TDStretchSSE::calcCrossCorr function in source/SoundTouch/sse_optimized.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted wav file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2017/Jul/62Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/42389/
http://seclists.org/fulldisclosure/2017/Jul/62Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/42389/

Timeline

Published: Jul 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-92616.5In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a craf CVE-2017-92626.5In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a craf CVE-2017-92636.5In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role statu CVE-2017-92649.8In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP,CVE-2017-92659.8In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in `lib/ofp-CVE-2017-92677.5In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used dur CVE-2017-92686.5In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authentic CVE-2017-92699.8In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to sile CVE-2017-92709.1In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database.CVE-2017-92713.3The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxie CVE-2017-92727.5The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack.CVE-2017-92735.3The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes.