Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03dmhtLWZtcGgtN3d4d84AA9wN
audify vulnerable to Improper Validation of Array Index
All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().decode or new OpusDecoder().decodeFloat functions it is not checked for negative values. This can lead to a process crash.
Permalink: https://github.com/advisories/GHSA-7vhm-fmph-7wxwJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03dmhtLWZtcGgtN3d4d84AA9wN
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 months ago
Updated: 30 days ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-7vhm-fmph-7wxw, CVE-2024-21522
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-21522
- https://gist.github.com/dellalibera/6bb866ae5d1cc2adaabe27bbd6d2d21e
- https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L79
- https://security.snyk.io/vuln/SNYK-JS-AUDIFY-6370700
- https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp#L53
- https://github.com/advisories/GHSA-7vhm-fmph-7wxw
Blast Radius: 6.3
Affected Packages
npm:audify
Dependent packages: 2Dependent repositories: 7
Downloads: 682 last month
Affected Version Ranges: <= 1.9.0
No known fixed version
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.3.2, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.6.0, 1.6.3, 1.7.0, 1.7.1, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.9.0