Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
89
security advisoryfedoraFedoraFedora 33 AUDIT-2021-64168929e4 Critical: Audacious Plugin Buffer Issue
AdPlug 2.3.3 fixes: (huge thanks to Alexander Miller for these) - CVE-2019-14690 - buffer overflow in `.bmf` - CVE-2019-14691 - buffer overflow in `.dtm` - CVE-2019-14692 - buffer overflow in `.mkj` - CVE-2019-14732 - buffer overflow in `.a2m` - CVE-2019-14733 - buffer overflow in `.rad` -. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-64168929e4 2021-01-14 01:37:01.292546 --------------------------------------------------------------------------------Name : audacious-plugins Product : Fedora 33 Version : 4.0.5 Release : 3.fc33 URL : https://audacious-media-player.org/ Summary : Plugins for the Audacious audio player Description : This package provides essential plugins for the Audacious audio player. --------------------------------------------------------------------------------Update Information: AdPlug 2.3.3 ============ - New RAD player replacing the old one - Bug fixes: (huge thanks to Alexander Miller for these) - CVE-2019-14690 - buffer overflow in `.bmf` - CVE-2019-14691 - buffer overflow in `.dtm` -CVE-2019-14692 - buffer overflow in `.mkj` - CVE-2019-14732 - buffer overflow in `.a2m` - CVE-2019-14733 - buffer overflow in `.rad` -CVE-2019-14734 - buffer overflow in `.mtk` - CVE-2019-15151 - double free and OOB reads in `.u6m` - OOB reads in `.xad` - OOB reads in `.rix` AdPlug 2.3.2 ============ - Bug fixes: - FMOPL: Fix global variable pointer double-free (CVE-2018-17825) - HERAD: Fix compilation on GCC 4.2.1 - ADL: Calling `rewind()` before `update()` causes access violation - Move OPL reset/init code to `rewind()` for some players AdPlug 2.3.1 ===========- Fixed unconditional inclusion of "sys/io.h" on Linux - Autotools improvement - Non-recursive Automake, improved parallelizability - Compatibility fixes for FreeBSD's pmake and OpenBSD's make - Out-of-source building AdPlug 2.3 ========== - Bug fixes: - CMF: Fix uninitialised variable use (thanks binarymaster) - CMF: Handle invalid offsets without crashing - ROL: Prevent access beyond end of vector - MSC: Fix use of uninitialised variable - HSC: Handle out of range patterns more gracefully - MID: Fix out of range array read - LDS: Use the tempo stored inside the Loudness-File instead of simply returning 70Hz - RIX: Fix several replay bugs (thanks to Palxex) - RIX: Big-endian fix by Wei Mingzhi - XAD: Tempo fix - Various other out of bounds array fixes, timing fixes, etc. - New formats: - BMF: Easy AdLib 1.0 - CMF: SoundFX Macs Opera - GOT: God of Thunder -HSQ/SQX/SDB/AGD/HA2: Herbulot AdLib System (HERAD) - MUS/IMS/MDI: AdLib Visual Composer ROL derivatives - SOP: sopepos' Note Player - VGM: Video Game Music - Allow compilation on platforms that don't support real OPL hardware access - Add support for compiling on Appveyor and publishing a NuGet package - Add Visual Studio 2015 projects - Add support for Travis CI builds - Add new CRC16 and CRC32 tests - Addition of WoodyOPL from DOSBox SVN (thanks to NY00123) - Addition of NukedOPL (thanks to loki666 and nukeykt) - Move from SourceForge to GitHub - DRO player refactored (thanks to Laurence Myers and William Yates) - Add (mono) OPL3 support to the surround/harmonic-effect OPL - Fix occasional random noise in right channel when using surround OPL and Satoh synth - Add display for ROL comment and instrument names - Improve support for different Westwood ADL format versions - Improve CMF transpose support (per-channel now) - Autotools build environment updated --------------------------------------------------------------------------------ChangeLog: * Tue Jan 5 2021 Robert Scheck - 4.0.5-3 - Rebuilt for adplug 2.3.3 --------------------------------------------------------------------------------References: [ 1 ] Bug #1743108 - CVE-2019-15151 adplug: double free infunction Cu6mPlayer in u6m.h https://bugzilla.redhat.com/show_bug.cgi?id=1743108 [ 2 ] Bug #1770224 - CVE-2019-14692 adplug: heap-based buffer overflow in CmkjPlayer::load() in mkj.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770224 [ 3 ] Bug #1770243 - CVE-2019-14690 adplug: heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770243 [ 4 ] Bug #1770257 - CVE-2019-14691 adplug: heap-based buffer overflow in CdtmLoader::load() in dtm.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770257 [ 5 ] Bug #1778710 - CVE-2019-14734 adplug: multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp https://bugzilla.redhat.com/show_bug.cgi?id=1778710 [ 6 ] Bug #1778716 - CVE-2019-14732 adplug: multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp https://bugzilla.redhat.com/show_bug.cgi?id=1778716 [ 7 ] Bug #1778720 - CVE-2019-14733 adplug: multiple heap-based buffer overflows in CradLoader::load() in rad.cp https://bugzilla.redhat.com/show_bug.cgi?id=1778720 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-64168929e4' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 13, 2021
•Critical
Fedora
91
security advisorydenial of servicegentooGentoo: GLSA-201203-14 Normal: Audacious Plugins Code Threat
Multiple vulnerabilities in Audacious Plugins could result in execution of arbitrary code or Denial of Service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201203-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Audacious Plugins: User-assisted execution of arbitrary code Date: March 16, 2012 Bugs: #383991 ID: 201203-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities in Audacious Plugins could result in execution of arbitrary code or Denial of Service. Background ========= Plugins for the Audacious music player. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-plugins/audacious-plugins < 3.1 > = 3.1 Description ========== Multiple vulnerabilities have been found in Audacious Plugins: * The "CSoundFile::ReadWav()" function in load_wav.cpp contains an integer overflow which could cause a heap-based buffer overflow (CVE-2011-2911). * The "CSoundFile::ReadS3M()" function in load_s3m.cpp contains multiple boundary errors which could cause a stack-based buffer overflow (CVE-2011-2912). * The "CSoundFile::ReadAMS()" function in load_ams.cpp contains an off-by-one error which could cause memory corruption (CVE-2011-2913). * The "CSoundFile::ReadDSM()" function in load_dms.cpp contains an off-by-one error which could cause memory corruption (CVE-2011-2914). * The "CSoundFile::ReadAMS2()" function in load_ams.cpp contains an off-by-one error which could cause memorycorruption (CVE-2011-2915). Impact ===== A remote attacker could entice a user to open a specially crafted media file, possibly resulting in execution of arbitrary code, or a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All Audacious Plugins users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v "> =media-plugins/audacious-plugins-3.1" References ========= [ 1 ] CVE-2011-2911 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2911 [ 2 ] CVE-2011-2912 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2912 [ 3 ] CVE-2011-2913 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2913 [ 4 ] CVE-2011-2914 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2914 [ 5 ] CVE-2011-2915 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2915 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201203-14 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Mar 16, 2012
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!