CVE-2017-18189: Debian Linux

High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days.

In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service.

Affected products

• Debian Debian Linux: version 8.0 only
• Sound Exchange Project Sound Exchange: up to and including 14.4.2

Published 2018-02-15. Last modified 2026-06-17.