CVE-2024-50612: 
NixOS vulnerability analysis and mitigation

libsndfile through version 1.2.2 contains a vulnerability in the oggvorbis.c file, specifically in the vorbisanalysis_wrote function, which leads to an out-of-bounds read condition. The vulnerability was discovered and disclosed on October 27, 2024, affecting all versions of libsndfile up to and including version 1.2.2 (MITRE CVE, NVD).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) with a CVSS v3.1 base score of 5.5 (Medium). The issue occurs in the vorbisanalysiswrote function at line 417 of ogg_vorbis.c, where an out-of-bounds read can be triggered when parsing specially crafted input files. The vulnerability manifests as a segmentation fault error when attempting to access memory at an invalid address (GitHub Issue).

When exploited, this vulnerability can lead to memory corruption and result in a Denial of Service (DoS) condition. The impact is primarily limited to availability, with no direct impact on confidentiality or integrity of the system (Ubuntu Security).

Fixed versions have been released for various distributions including Ubuntu 24.10 (1.2.2-1ubuntu5.24.10.1), Ubuntu 24.04 LTS (1.2.2-1ubuntu5.24.04.1), and other supported versions. The fix is implemented in the upstream repository through commit 4755f5b (Ubuntu Security).