Debian 11: Critical DoS Vulnerabilities Resolved in libsndfile DLA-4287-1

Two vulnerabilities have been fixed in the audio data read/write library
libsndfile.

CVE-2022-33065

Multiple signed integers overflow in function au_read_header in src/au.c
and in functions mat4_open and mat4_read_header in src/mat4.c in
Libsndfile, allows an attacker to cause Denial of Service or other
unspecified impacts.

CVE-2024-50612

Out-of-bounds read in ogg_vorbis.c vorbis_analysis_wrote() can cause
memory corruption when parsing a specially crafted input file. This
vulnerability leads to Denial of Service (DoS).

For Debian 11 bullseye, these problems have been fixed in version
1.0.31-2+deb11u1.

We recommend that you upgrade your libsndfile packages.

For the detailed security status of libsndfile please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/libsndfile

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be