CVE-2012-2106

Name of the Vulnerable Software and Affected Versions Csound versions prior to 5.16.6

Description The issue is related to an integer overflow in the pv import function, located in util/lpv import.c, which occurs when converting a file. This allows remote attackers to execute arbitrary code through a crafted file, resulting in a heap-based buffer overflow.

Recommendations For versions prior to 5.16.6, update to version 5.16.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the pv import function in util/lpv import.c to minimize the risk of exploitation. Avoid using the pv import function with untrusted input files until the issue is resolved.