CVE-2015-7747

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-19 · updated 2026-06-17
Weakness: CWE-120

Description

Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c.

Affected products

Audiofile: before 0.3.6 — fixed in 0.3.6
Canonical Ubuntu Linux: 12.04, 14.04, 15.04, 15.10
Fedoraproject Fedora: 23

How to fix

Upgrade to a fixed version: Audiofile 0.3.6. Check the vendor advisory for mitigations.

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170387.html
http://www.openwall.com/lists/oss-security/2015/10/06/2
http://www.ubuntu.com/usn/USN-2787-1
https://bugs.launchpad.net/ubuntu/+source/audiofile/+bug/1502721
https://github.com/ccrisan/motioneyeos/blob/master/package/audiofile/0008-CVE-2015-7747.patch
https://www.openwall.com/lists/oss-security/2015/10/08/1
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170387.html
http://www.openwall.com/lists/oss-security/2015/10/06/2
http://www.ubuntu.com/usn/USN-2787-1
https://bugs.launchpad.net/ubuntu/+source/audiofile/+bug/1502721
https://github.com/ccrisan/motioneyeos/blob/master/package/audiofile/0008-CVE-2015-7747.patch
https://www.openwall.com/lists/oss-security/2015/10/08/1

Get alerted when CVE-2015-7747 or the next vulnerability affects your stack