Hugo Lefeuvre pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
504636b8 by Hugo Lefeuvre at 2018-12-24T10:37:40Z
libsndfile: add fix for alaw and ulaw issues
This fix addresses CVE-2018-19661, CVE-2018-19662, CVE-2017-17456 and
CVE-2017-17457.
CVE-2017-14245 and CVE-2017-14246 are fixed as well since they are
duplicates of CVE-2017-17456 and CVE-2017-17457.
I have already asked for rejection when appropriate but didn't get any
answer from the mitre team yet.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5792,11 +5792,13 @@ CVE-2018-19662 (An issue was discovered in libsndfile
1.0.28. There is a buffer
- libsndfile <unfixed> (low)
[stretch] - libsndfile <no-dsa> (Minor issue)
NOTE: https://github.com/erikd/libsndfile/issues/429
+ NOTE:
https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
NOTE: similar to CVE-2017-17456/CVE-2017-17457 (but not duplicate)
CVE-2018-19661 (An issue was discovered in libsndfile 1.0.28. There is a
buffer ...)
- libsndfile <unfixed> (low)
[stretch] - libsndfile <no-dsa> (Minor issue)
NOTE: https://github.com/erikd/libsndfile/issues/429
+ NOTE:
https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
NOTE: similar to CVE-2017-17456/CVE-2017-17457 (but not duplicate)
CVE-2018-19660 (An exploitable authenticated command-injection vulnerability
exists in ...)
NOT-FOR-US: Moxa
@@ -58987,6 +58989,7 @@ CVE-2017-17457 (The function d2ulaw_array() in ulaw.c
of libsndfile 1.0.29pre1 m
[jessie] - libsndfile <no-dsa> (Minor issue)
[wheezy] - libsndfile <no-dsa> (Minor issue)
NOTE: https://github.com/erikd/libsndfile/issues/344
+ NOTE:
https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
NOTE: Might be a duplicate of CVE-2017-14245/CVE-2017-14246
CVE-2017-17456 (The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1
may lead ...)
- libsndfile <unfixed> (low; bug #884735)
@@ -58994,6 +58997,7 @@ CVE-2017-17456 (The function d2alaw_array() in alaw.c
of libsndfile 1.0.29pre1 m
[jessie] - libsndfile <no-dsa> (Minor issue)
[wheezy] - libsndfile <no-dsa> (Minor issue)
NOTE: https://github.com/erikd/libsndfile/issues/344
+ NOTE:
https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
NOTE: Might be a duplicate of CVE-2017-14245/CVE-2017-14246
CVE-2017-17455 (Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10
before ...)
- mahara <removed>
@@ -71766,12 +71770,14 @@ CVE-2017-14246 (An out of bounds read in the function
d2ulaw_array() in ulaw.c o
[jessie] - libsndfile <no-dsa> (Minor issue)
[wheezy] - libsndfile <no-dsa> (Minor issue)
NOTE: https://github.com/erikd/libsndfile/issues/317
+ NOTE:
https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
CVE-2017-14245 (An out of bounds read in the function d2alaw_array() in alaw.c
of ...)
- libsndfile <unfixed> (low; bug #876682)
[stretch] - libsndfile <no-dsa> (Minor issue)
[jessie] - libsndfile <no-dsa> (Minor issue)
[wheezy] - libsndfile <no-dsa> (Minor issue)
NOTE: https://github.com/erikd/libsndfile/issues/317
+ NOTE:
https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
CVE-2017-14244 (An authentication bypass vulnerability on iBall Baton ADSL2+
Home ...)
NOT-FOR-US: iBall
CVE-2017-14243 (An authentication bypass vulnerability on UTStar WA3002G4 ADSL
...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/504636b8acf2e1499edeb41fab206da54417579c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/504636b8acf2e1499edeb41fab206da54417579c
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
