CVE-2017-7605
HighSummary
The HE-AAC+ Codec (libaacplus) version 2.0.2 has an assertion failure that may allow remote attackers to cause an application crash (denial of service) or potentially have unspecified other impact via a crafted audio file.
Risk Assessment
The organization may be vulnerable to attacks that lead to application crashes, potentially disrupting services and affecting system availability.
Recommendation
It is recommended to update the HE-AAC+ Codec library to the latest version to mitigate this vulnerability and to monitor systems for suspicious audio files.
Other vulnerabilities in HE-AAC+ Codec (libaacplus) 2.0.2
See all- CVE-2017-7604High
The HE-AAC+ Codec (libaacplus) version 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause application crashes or potentially other unspecified impacts via a crafted audio file.
- CVE-2017-7603High
The au_channel.h file in the HE-AAC+ Codec (libaacplus) version 2.0.2 has a signed integer overflow, which may allow remote attackers to cause application crashes or potentially have unspecified other impacts via a crafted audio file.
Original NVD description (English source)
aacplusenc.c in HE-AAC+ Codec (aka libaacplus) 2.0.2 has an assertion failure, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.