Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 538
Alerts This Week
Warning Icon 1 538

Debian 8: DLA-1618-1 Moderate: libsndfile Denial Of Service Issues

debian lts
Calendar Grey December 26, 2018
Dist Debian Esm H88
Package : libsndfile Version : 1.0.25-9.1+deb8u2 CVE ID : CVE-2017-8361 CVE-2017-8362 CVE-2017-8363
Multiple vulnerabilities have been found in libsndfile, the library for reading and writing files containing sampled sound
Topics%20covered

Topics Covered

security advisory denial of service buffer overflow out-of-bounds read libsndfile Debian LTS audio file issue

Summary

The flac_buffer_copy function (flac.c) is affected by a buffer
overflow. This vulnerability might be leveraged by remote attackers to
cause a denial of service, or possibly have unspecified other impact
via a crafted audio file.

CVE-2017-8362

The flac_buffer_copy function (flac.c) is affected by an out-of-bounds
read vulnerability. This flaw might be leveraged by remote attackers to
cause a denial of service via a crafted audio file.

CVE-2017-8363

The flac_buffer_copy function (flac.c) is affected by a heap based OOB
read vulnerability. This flaw might be leveraged by remote attackers to
cause a denial of service via a crafted audio file.

CVE-2017-8365

The i2les_array function (pcm.c) is affected by a global buffer
overflow. This vulnerability might be leveraged by remote attackers to
cause a denial of service, or possibly have unspecified other impact
via a crafted audio file.

CVE-2017-14245
CVE-2017-14246
CVE-2017-17456
CVE-2017-17457

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Package: libsndfile
Version: 1.0.25-9.1+deb8u2
CVE ID: CVE-2017-8361 CVE-2017-8362 CVE-2017-8363 CVE-2017-8365

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow out-of-bounds read libsndfile Debian LTS audio file issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.