CVE-2017-7604
HighSummary
The HE-AAC+ Codec (libaacplus) version 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause application crashes or potentially other unspecified impacts via a crafted audio file.
Risk Assessment
The organization may be vulnerable to attacks that lead to application crashes, potentially disrupting service availability and affecting system operations.
Recommendation
It is recommended to update the HE-AAC+ Codec library to the latest version to mitigate this vulnerability and to monitor systems for suspicious audio files.
Other vulnerabilities in HE-AAC+ Codec (libaacplus) 2.0.2
See all- CVE-2017-7605High
The HE-AAC+ Codec (libaacplus) version 2.0.2 has an assertion failure that may allow remote attackers to cause an application crash (denial of service) or potentially have unspecified other impact via a crafted audio file.
- CVE-2017-7603High
The au_channel.h file in the HE-AAC+ Codec (libaacplus) version 2.0.2 has a signed integer overflow, which may allow remote attackers to cause application crashes or potentially have unspecified other impacts via a crafted audio file.
Original NVD description (English source)
au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.