Mageia 2018-0441: audiofile security update
Summary
A NULL pointer dereference in modules/ModuleState.cpp:ModuleState::setup()
allows for denial of service via crafted file (CVE-2018-13440).
A Heap-based buffer overflow was found in Expand3To4Module::run when
running sfconvert (CVE-2018-17095).
References
- https://bugs.mageia.org/show_bug.cgi?id=23754
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IILVUXOJMQBFB3GUWXZZXN4PLR3PV4IO/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13440
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17095
Resolution
MGASA-2018-0441 - Updated audiofile packages fix security vulnerabilities
SRPMS
- 6/core/audiofile-0.3.6-8.1.mga6
![Dist Mageia](/images/distros/dist-mageia.jpg)