CVE-2017-14246

Name of the Vulnerable Software and Affected Versions libsndfile version 1.0.28

Description The issue is related to an out of bounds read in the d2ulaw array() function in ulaw.c of libsndfile, which may lead to a remote denial of service attack or information disclosure. This is due to the mishandling of the NAN and INFINITY floating-point values. The vulnerability can be exploited by a remote attacker to gain access to confidential data and cause a denial of service.

Recommendations For libsndfile version 1.0.28, consider applying a patch or fix that correctly handles the NAN and INFINITY floating-point values in the d2ulaw array() function to prevent out of bounds reads. As a temporary workaround, restrict access to the d2ulaw array() function until a patch is available.