Security update for libsndfile SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:2209-1 Final 1 1 2018-08-06T08:47:12Z current 2018-08-06T08:47:12Z 2018-08-06T08:47:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libsndfile This update for libsndfile fixes the following issues: Security issues fixed: - CVE-2018-13139: Fix a stack-based buffer overflow in psf_memset in common.c that allows remote attackers to cause a denial of service (bsc#1100167). - CVE-2017-17456: Prevent segmentation fault in the function d2alaw_array() that may have lead to a remote DoS (bsc#1071777) - CVE-2017-17457: Prevent segmentation fault in the function d2ulaw_array() that may have lead to a remote DoS, a different vulnerability than CVE-2017-14246 (bsc#1071767) This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00010.html E-Mail link for openSUSE-SU-2018:2209-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 15.0 libsndfile-1.0.28-lp150.3.3.1 libsndfile-devel-1.0.28-lp150.3.3.1 libsndfile-progs-1.0.28-lp150.3.3.1 libsndfile1-1.0.28-lp150.3.3.1 libsndfile1-32bit-1.0.28-lp150.3.3.1 libsndfile-1.0.28-lp150.3.3.1 as a component of openSUSE Leap 15.0 libsndfile-devel-1.0.28-lp150.3.3.1 as a component of openSUSE Leap 15.0 libsndfile-progs-1.0.28-lp150.3.3.1 as a component of openSUSE Leap 15.0 libsndfile1-1.0.28-lp150.3.3.1 as a component of openSUSE Leap 15.0 libsndfile1-32bit-1.0.28-lp150.3.3.1 as a component of openSUSE Leap 15.0 The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14245. CVE-2017-17456 openSUSE Leap 15.0:libsndfile-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile-devel-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile-progs-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile1-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile1-32bit-1.0.28-lp150.3.3.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00010.html https://www.suse.com/security/cve/CVE-2017-17456.html CVE-2017-17456 https://bugzilla.suse.com/1059912 SUSE Bug 1059912 https://bugzilla.suse.com/1071777 SUSE Bug 1071777 https://bugzilla.suse.com/1117906 SUSE Bug 1117906 The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14246. CVE-2017-17457 openSUSE Leap 15.0:libsndfile-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile-devel-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile-progs-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile1-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile1-32bit-1.0.28-lp150.3.3.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00010.html https://www.suse.com/security/cve/CVE-2017-17457.html CVE-2017-17457 https://bugzilla.suse.com/1059913 SUSE Bug 1059913 https://bugzilla.suse.com/1071767 SUSE Bug 1071767 https://bugzilla.suse.com/1117906 SUSE Bug 1117906 A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. CVE-2018-13139 openSUSE Leap 15.0:libsndfile-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile-devel-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile-progs-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile1-1.0.28-lp150.3.3.1 openSUSE Leap 15.0:libsndfile1-32bit-1.0.28-lp150.3.3.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00010.html https://www.suse.com/security/cve/CVE-2018-13139.html CVE-2018-13139 https://bugzilla.suse.com/1100167 SUSE Bug 1100167 https://bugzilla.suse.com/1116993 SUSE Bug 1116993