Ubuntu 23.10 USN-6471-1 Moderate: Libsndfile Denial Of Service Risk

ubuntu

November 2, 2023

libsndfile could be made to crash if it received specially crafted input.

Summary

libsndfile could be made to crash if it received specially crafted

input.

Software Description:

- libsndfile: Library for reading/writing audio files

Details:

It was discovered that libsndfile contained multiple arithmetic overflows.

If a user or automated system were tricked into processing a specially

crafted audio file, an attacker could possibly use this issue to cause a

denial of service.

Topics Covered

security advisory denial of service Ubuntu libsndfile arithmetic overflow

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   libsndfile1                     1.2.2-1ubuntu0.23.10.1
   sndfile-programs                1.2.2-1ubuntu0.23.10.1

Ubuntu 23.04:
   libsndfile1                     1.2.0-1ubuntu0.1
   sndfile-programs                1.2.0-1ubuntu0.1

Ubuntu 22.04 LTS:
   libsndfile1                     1.0.31-2ubuntu0.1
   sndfile-programs                1.0.31-2ubuntu0.1

Ubuntu 20.04 LTS:
   libsndfile1                     1.0.28-7ubuntu0.2
   sndfile-programs                1.0.28-7ubuntu0.2

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   libsndfile1                     1.0.28-4ubuntu0.18.04.2+esm1
   sndfile-programs                1.0.28-4ubuntu0.18.04.2+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   libsndfile1                     1.0.25-10ubuntu0.16.04.3+esm3
   sndfile-programs                1.0.25-10ubuntu0.16.04.3+esm3

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
   libsndfile1                     1.0.25-7ubuntu2.2+esm3
   sndfile-programs                1.0.25-7ubuntu2.2+esm3

In general, a standard system update will make all the necessary changes.