CVE-2004-0557

NameCVE-2004-0557
DescriptionMultiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-565-1
Debian Bugs262083

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
sox (PTS)jessie, jessie (lts)14.4.1-5+deb8u7fixed
stretch (lts), stretch14.4.1-5+deb9u5fixed
buster14.4.2+git20190427-1fixed
buster (security)14.4.2+git20190427-1+deb10u3fixed
bullseye (security), bullseye14.4.2+git20190427-2+deb11u2fixed
bookworm14.4.2+git20190427-3.5fixed
sid, trixie14.4.2+git20190427-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
soxsourcewoody12.17.3-4woody2DSA-565-1262083
soxsource(unstable)12.17.4-9262083
Search for package or bug name: Reporting problems