GCVE - cpe:2.3:a:sound_exchange_project:sound

Approved changes feed: RSS · Atom

cpe:2.3:a:sound_exchange_project:sound_exchange:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Sound Exchange Project (`1cb0f1ed-375d-5550-a718-fdd7a969135e`)
Product	Sound Exchange (`f9d54ebb-e5fd-5ab9-82de-5c00a3d867c2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/sox`	purl2cpe	2026-06-01 10:16:13.256314
`pkg:deb/ubuntu/sox`	purl2cpe	2026-06-01 10:16:13.256317
`pkg:github/rbouqueau/sox`	purl2cpe	2026-06-01 10:16:13.256320
`pkg:rpm/fedora/sox`	purl2cpe	2026-06-01 10:16:13.256323
`pkg:rpm/opensuse/sox`	purl2cpe	2026-06-01 10:16:13.256325
`pkg:sourceforge/sox`	purl2cpe	2026-06-01 10:16:13.256328

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-34432`	vulnerable	2026-06-08 06:06:25.579213	Heap-buffer-overflow in src/formats_i.c HIGH (7.8) A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure. Published: 2023-07-10T20:05:39.681Z Updated: 2024-10-01T16:24:35.073Z Open on db.gcve.eu Reference links https://access.redhat.com/security/cve/CVE-2023-34432 https://bugzilla.redhat.com/show_bug.cgi?id=2212291	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-1010004`	vulnerable	2026-06-08 05:12:21.543200	Details available SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189. Published: 2019-07-15T01:44:34.000Z Updated: 2024-08-05T03:07:18.416Z Open on db.gcve.eu Reference links https://sourceforge.net/p/sox/bugs/299/ https://sourceforge.net/p/sox/code/ci/master/tree/src/xa.c#l219	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-18189`	vulnerable	2026-06-08 05:09:10.540503	Details available In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service. Published: 2018-02-15T10:00:00.000Z Updated: 2024-08-05T21:13:49.061Z Open on db.gcve.eu Reference links https://public-inbox.org/sox-devel/20171109114554.16297-1-mans%40mansr.com/raw https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881121 https://lists.debian.org/debian-lts-announce/2019/02/msg00042.html https://access.redhat.com/errata/RHSA-2019:2283 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUKFZQSZG2ABMTAMOGBMY7MJNSGEIYTL/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8145`	vulnerable	2026-06-08 05:06:08.123850	Details available Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function. Published: 2014-12-31T22:00:00.000Z Updated: 2024-08-06T13:10:50.932Z Open on db.gcve.eu Reference links http://www.mandriva.com/security/advisories?name=MDVSA-2015:015 http://www.debian.org/security/2014/dsa-3112 http://packetstormsecurity.com/files/129699/SoX-14.4.1-Heap-Buffer-Overflow.html http://www.securityfocus.com/bid/71774 https://lists.debian.org/debian-lts-announce/2019/02/msg00034.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Sound Exchange

Notes

PURL mappings

Vulnerability references

Contribute