Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowFedora

Fedora 25 Libsndfile Security Update: Critical Buffer Overflow Fix

* updated to 1.0.28 * fixes possible buffer overflow when parsing crafted ID3 tags (#1440758, CVE-2017-7586) * fixes possible buffer overflow when parsing crafted flac file (#1440756, CVE-2017-7585). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-72a971ccf0 2017-04-14 17:18:15.814393 --------------------------------------------------------------------------------Name : libsndfile Product : Fedora 25 Version : 1.0.28 Release : 1.fc25 URL : http://www.mega-nerd.com/libsndfile/ Summary : Library for reading and writing sound files Description : libsndfile is a C library for reading and writing sound files such as AIFF, AU, WAV, and others through one standard interface. It can currently read/write 8, 16, 24 and 32-bit PCM files as well as 32 and 64-bit floating point WAV files and a number of compressed formats. It compiles and runs on *nix, MacOS, and Win32. --------------------------------------------------------------------------------Update Information: * updated to 1.0.28 * fixes possible buffer overflow when parsing crafted ID3 tags (#1440758, CVE-2017-7586) * fixes possible buffer overflow when parsing crafted flac file (#1440756, CVE-2017-7585) --------------------------------------------------------------------------------References: [ 1 ] Bug #1440756 - CVE-2017-7585 libsndfile: Stack-based buffer overflow in flac_buffer_copy() https://bugzilla.redhat.com/show_bug.cgi?id=1440756 [ 2 ] Bug #1440758 - CVE-2017-7586 libsndfile: Error in header_read() causing stack-based buffer overflow https://bugzilla.redhat.com/show_bug.cgi?id=1440758 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade libsndfile' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html Allpackages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. . Upgrade Fedora's libsndfile to version 1.0.28 to mitigate severe buffer overflow vulnerabilities occurring during audio file parsing, ensuring improved security and stability.. Fedora Software Update, Libsndfile Fix, Buffer Overflow Resolution. . Severity: Critical. LinuxSecurity.com Team

Apr 14, 2017 •Critical Fedora