Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Fedora 40: FEDORA-2025-5ef10f8485 critical: SDL2_sound buffer overflow

fedora
Calendar Grey January 23, 2025
Dist Fedora Esm H88
Fedora 40's latest security advisory for SDL2_sound addresses significant memory management vulnerabilities. Users are urged to apply updates promptly to enhance security and stability
Latest stable release from upstream

Summary

SDL_sound is a library that handles the decoding of several popular sound

file formats, such as .WAV and .OGG. It is meant to make the programmer's

sound playback tasks simpler. The programmer gives SDL_sound a filename,

or feeds it data directly from one of many sources, and then reads the

decoded waveform data back at her leisure. If resource constraints are a

concern, SDL_sound can process sound data in programmer-specified blocks.

Alternately, SDL_sound can decode a whole sound file and hand back a

single pointer to the whole waveform. SDL_sound can also handle sample

rate, audio format, and channel conversion on-the-fly and

behind-the-scenes, if the programmer desires.

Update Information:

Latest stable release from upstream. Changelog: https://github.com/icculus/SDL_sound/releases/tag/v2.0.4 . NOTE: dr_libs are unbundled. Fixes: CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder() CVE-2023-45677: Heap buffer out of bounds write in start_decoder() CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit() CVE-2023-45680: Null pointer dereference in vorbis_deinit() CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit() CVE-2023-45680: Null pointer dereference in vorbis_deinit() CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()

Topics%20covered

Topics Covered

security advisory buffer overflow heap corruption Fedora update information SDL2_sound

Change Log

* Tue Jan 14 2025 Dominik Mierzejewski - 2.0.4-1 - update to 2.0.4 (resolves rhbz#2337428) - correct License tag after review * Tue Dec 17 2024 Benjamin A. Beasley - 2.0.2-6 - Unbundle dr_flac and dr_mp3 * Wed Sep 4 2024 Miroslav Suchý - 2.0.2-5 - convert license to SPDX * Wed Jul 17 2024 Fedora Release Engineering - 2.0.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

References


[ 1 ] Bug #2337428 - SDL2_sound-2.0.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=2337428

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-5ef10f8485' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: SDL2_sound
Product: Fedora 40
Version: 2.0.4
Release: 1.fc40
URL: http://www.icculus.org/SDL_sound
Summary: An abstract soundfile decoder library

Topics%20covered

Topics Covered

security advisory buffer overflow heap corruption Fedora update information SDL2_sound

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here