Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In aubio 0.4.6, a divide-by-zero error exists in the function newaubiosourcewavread() in sourcewavread.c, which may lead to DoS when playing a crafted audio file.
Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A NULL pointer dereference (DoS) Vulnerability was found in the function aubiosourceavcodecreadframe in io/sourceavcodec.c of aubio, which may lead to DoS when playing a crafted audio file.
Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubiosourceavcodecreadframe in io/sourceavcodec.c, as demonstrated by aubiomfcc.
Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubiopitchsetunit in pitch/pitch.c, as demonstrated by aubionotes.
Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in aubio 0.4.6. A buffer over-read can occur in newaubiopitchyinfft in pitch/pitchyinfft.c when the samplerate of the input file is larger than 50kHz.
Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
aubio v0.4.0 to v0.4.8 has a Buffer Overflow in newaubiotempo.
Recommended action: Upgrade to 0.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
aubio v0.4.0 to v0.4.8 has a newaubioonset NULL pointer dereference in newaubionotes function within src/notes/notes.c.
Recommended action: Upgrade to 0.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in newaubiofilterbank via invalid nfilters.
Recommended action: Upgrade to 0.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.