CVE-2017-7603
HighSummary
The au_channel.h file in the HE-AAC+ Codec (libaacplus) version 2.0.2 has a signed integer overflow, which may allow remote attackers to cause application crashes or potentially have unspecified other impacts via a crafted audio file.
Risk Assessment
This vulnerability may lead to application crashes, affecting service availability. There is also a risk of unspecified impacts that could affect system integrity.
Recommendation
It is recommended to update the HE-AAC+ codec to the latest version to mitigate this vulnerability. Additionally, monitor and validate audio files before processing them.
Other vulnerabilities in HE-AAC+ Codec (libaacplus) 2.0.2
See all- CVE-2017-7605High
The HE-AAC+ Codec (libaacplus) version 2.0.2 has an assertion failure that may allow remote attackers to cause an application crash (denial of service) or potentially have unspecified other impact via a crafted audio file.
- CVE-2017-7604High
The HE-AAC+ Codec (libaacplus) version 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause application crashes or potentially other unspecified impacts via a crafted audio file.
Original NVD description (English source)
au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.