CVE-2018-13440

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mpruett/audiofile/issues/49Exploit, Third Party Advisory
https://usn.ubuntu.com/3800-1/Third Party Advisory
https://github.com/mpruett/audiofile/issues/49Exploit, Third Party Advisory
https://usn.ubuntu.com/3800-1/Third Party Advisory

Timeline

Published: Jul 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-134415.5qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a loca CVE-2018-134428.8SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntit CVE-2018-134438.8EOS.IO jit-wasm 4.1 has a heap-based buffer overflow via a crafted wast file.CVE-2018-134448.8An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/admin_manager.php?action=save&CVE-2018-134458.8An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/admin_manager.php?action=add.CVE-2018-134467.0An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runti CVE-2018-134479.8SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands CVE-2018-134489.8SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands CVE-2018-134499.8SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands CVE-2018-13458.8NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack.CVE-2018-134509.8SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands CVE-2018-134575.5qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denia