Ubuntu 22.10 USN-5904-2 Security Advisory: SoX Regression Issue

ubuntu

March 21, 2023

USN-5904-1 caused a minor regression in SoX.

Summary

USN-5904-1 caused a minor regression in SoX.

Software Description:

- sox: Swiss army knife of sound processing

Details:

USN-5904-1 fixed vulnerabilities in SoX. It was discovered that the fix for

CVE-2021-33844 was incomplete. This update fixes the problem.

Original advisory details:

Helmut Grohne discovered that SoX incorrectly handled certain inputs. If a

user or an automated system were tricked into opening a specially crafted

input file, a remote attacker could possibly use this issue to cause a

denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu

16.04 ESM,

and Ubuntu 18.04 LTS. (CVE-2019-13590)

Helmut Grohne discovered that SoX incorrectly handled certain inputs. If a

user or an automated system were tricked into opening a specially crafted

input file, a remote attacker could possibly use this issue to cause a

denial of service. (CVE-2021-23159, CVE-2021-23172, CVE-2021-23210,

CVE-2021-33844, CVE-2021-3643, CV...

Read the Full Advisory

Topics Covered

security advisory denial of service security issue update SoX Ubuntu regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   libsox3                         14.4.2+git20190427-3ubuntu0.2
   sox                             14.4.2+git20190427-3ubuntu0.2

Ubuntu 22.04 LTS:
   libsox3 
14.4.2+git20190427-2+deb11u2build0.22.04.1
   sox 
14.4.2+git20190427-2+deb11u2build0.22.04.1

Ubuntu 20.04 LTS:
   libsox3 
14.4.2+git20190427-2+deb11u2build0.20.04.1
   sox 
14.4.2+git20190427-2+deb11u2build0.20.04.1

Ubuntu 18.04 LTS:
   libsox3                         14.4.2-3ubuntu0.18.04.3
   sox                             14.4.2-3ubuntu0.18.04.3

Ubuntu 16.04 ESM:
   libsox2                         14.4.1-5+deb8u4ubuntu0.1+esm2
   sox                             14.4.1-5+deb8u4ubuntu0.1+esm2

Ubuntu 14.04 ESM:
   libsox2                         14.4.1-3ubuntu1.1+esm3
   sox                             14.4.1-3ubuntu1.1+esm3

In general, a standard system update will make all the necessary changes.