CVE-2017-14245

Name of the Vulnerable Software and Affected Versions libsndfile version 1.0.28

Description The issue is related to an out of bounds read in the d2alaw array() function, which can be exploited by a remote attacker to gain access to confidential information or cause a denial of service. This is due to the mishandling of NAN and INFINITY floating-point values.

Recommendations For libsndfile version 1.0.28, consider disabling the d2alaw array() function as a temporary workaround until a patch is available. Restrict access to the alaw.c module to minimize the risk of exploitation. Avoid using the d2alaw array() function in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.