Debian Long Term Support / LTS Security Information / 2017 / Security Information -- DLA-956-1 libsndfile

Debian Security Advisory

DLA-956-1 libsndfile -- LTS security update

Date Reported:

28 May 2017

Affected Packages:

libsndfile

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2017-8361, CVE-2017-8362, CVE-2017-8363, CVE-2017-8365.

More information:

• CVE-2017-8361

  The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.

• CVE-2017-8362

  The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file.

• CVE-2017-8363

  The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.

• CVE-2017-8365

  The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.

For Debian 7 Wheezy, these problems have been fixed in version 1.0.25-9.1+deb7u2.

We recommend that you upgrade your libsndfile packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS