Source: alsa-lib Version: 1.2.16.1-1 Severity: important Tags: security upstream Forwarded: https://lore.kernel.org/alsa-devel/CACBQ=p2fho3m6dkv3cwukb6qhs92ouv+fj3sjz_pvbssdjw...@mail.gmail.com/ X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for alsa-lib. CVE-2026-90781[0]: | alsa-lib through 1.2.16.1 contains a stack buffer overflow in the | __snd_ctl_ascii_elem_id_parse() function that writes one byte past a | 64-byte buffer when parsing a name= field with 64 or more | characters. Attackers can supply a long control-element identifier | string through saved state files or command-line arguments to | overwrite adjacent stack memory and crash the calling process. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-90781 https://www.cve.org/CVERecord?id=CVE-2026-90781 [1] https://lore.kernel.org/alsa-devel/CACBQ=p2fho3m6dkv3cwukb6qhs92ouv+fj3sjz_pvbssdjw...@mail.gmail.com/ [2] https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
