Alsa Project
Monthly
Memory corruption in the Advanced Linux Sound Architecture (ALSA) user-space library (alsa-lib) before 1.2.16.1 allows local attackers to crash audio-dependent processes by feeding maliciously crafted configuration text to parse_def() in src/conf.c. The flaw is a double-free reachable through nested compound or array config blocks, leading to a NULL-pointer write or invalid read; publicly available exploit code exists (reported by VulnCheck), but the issue is not on the CISA KEV list.
Stack buffer overflow in alsa-lib through 1.2.16.1 allows local low-privilege attackers to crash any process consuming ALSA control-element identifiers by supplying a name= field of 64 or more characters via saved state files or command-line arguments. The off-by-one condition in __snd_ctl_ascii_elem_id_parse() (ctlparse.c:216-241) writes one byte past a 64-byte stack buffer, corrupting adjacent stack memory and causing process termination. No public exploit is identified at time of analysis; modern stack-canary mitigations further limit exploitation beyond DoS.
posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descriptor close" issue during a failed connection attempt when. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Memory corruption in the Advanced Linux Sound Architecture (ALSA) user-space library (alsa-lib) before 1.2.16.1 allows local attackers to crash audio-dependent processes by feeding maliciously crafted configuration text to parse_def() in src/conf.c. The flaw is a double-free reachable through nested compound or array config blocks, leading to a NULL-pointer write or invalid read; publicly available exploit code exists (reported by VulnCheck), but the issue is not on the CISA KEV list.
Stack buffer overflow in alsa-lib through 1.2.16.1 allows local low-privilege attackers to crash any process consuming ALSA control-element identifiers by supplying a name= field of 64 or more characters via saved state files or command-line arguments. The off-by-one condition in __snd_ctl_ascii_elem_id_parse() (ctlparse.c:216-241) writes one byte past a 64-byte stack buffer, corrupting adjacent stack memory and causing process termination. No public exploit is identified at time of analysis; modern stack-canary mitigations further limit exploitation beyond DoS.
posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descriptor close" issue during a failed connection attempt when. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.