CVE-2015-7805: mega-nerd libsndfile

CVSS: 9.3v2.0HighModified

AliasesMGASA-2015-0455UBUNTU-CVE-2015-7805DEBIAN-CVE-2015-7805

Published 17-11-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-7805 is a high (CVSS 9.3) vulnerability in mega-nerd libsndfile. EPSS estimates a 14.27% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

14.27%

0%100%

Medium · +0.98 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 8 · Related 6

DLA-356-1 DLA-928-1 OPENSUSE-SU-2024:10148-1 OPENSUSE-SU-2024:10470-1 SUSE-SU-2015:1979-1 SUSE-SU-2015:2000-1+2 more

Timeline

17-11-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

14.27%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

+0.98 pp

From 13.29% on 20-09-2026

20-09-202620-10-2026

EPSS score

14.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaselocalmultipleUnverified
libsndfile 1.0.25 - Local Heap Overflow
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian1 product

libsndfile< 1.0.25-10

Mageia1 product

libsndfile< 1.0.25-9.1.mga5

Mega-nerd1 product

libsndfile1.0.25

Opensuse1 product

opensuseEOL13.1 | 13.2

Ubuntu1 product

libsndfile< 1.0.25-7ubuntu2.1

5 vendors · 5 products

References

20 links

www.openwall.com/lists/oss-security/2015/11/03/7Mailing ListX Refsource MLIST
lists.opensuse.org/opensuse-updates/2015-11/msg00077.htmlVendor AdvisoryX Refsource SUSEWEB
www.securityfocus.com/bid/77427VDB EntryX Refsource BID
packetstormsecurity.com/files/133926/libsndfile-1.0.25-Heap-Overflow.htmlX Refsource MISCExploit
www.ubuntu.com/usn/USN-2832-1Vendor AdvisoryX Refsource UBUNTU
security.gentoo.org/glsa/201612-03Vendor AdvisoryX Refsource GENTOO
lists.fedoraproject.org/pipermail/package-announce/2015-November/172607.htmlVendor AdvisoryX Refsource FEDORA
lists.opensuse.org/opensuse-updates/2015-11/msg00145.htmlVendor AdvisoryX Refsource SUSE
www.openwall.com/lists/oss-security/2015/11/03/3Mailing ListX Refsource MLIST
www.nemux.org/2015/10/13/libsndfile-1-0-25-heap-overflow/X Refsource MISCWEBREPORT

Show all 20 references

lists.fedoraproject.org/pipermail/package-announce/2015-November/172593.htmlVendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/pipermail/package-announce/2015-November/171466.htmlVendor AdvisoryX Refsource FEDORA
www.exploit-db.com/exploits/38447/ExploitX Refsource EXPLOIT DBREPORT
advisories.mageia.org/MGASA-2015-0455.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=17163REPORT
packetstormsecurity.com/files/133926/libsndfile-1.0.25-Heap-Overflow.htmlWEB
ubuntu.com/security/CVE-2015-7805REPORT
ubuntu.com/security/notices/USN-2832-1Advisory
www.cve.org/CVERecord?id=CVE-2015-7805REPORT
security-tracker.debian.org/tracker/CVE-2015-7805Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities