One of the security fixes released as DLA 3315 introduced a regression in the processing WAV files with variable bitrate encoding. Updated sox packages are available to correct this issue. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3315-2
An update that fixes four vulnerabilities is now available.. openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0053-1 Rating: important References: #1160337 Cross-References: CVE-2019-5844 CVE-2019-5845 CVE-2019-5846 CVE-2020-6377 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium version 79.0.3945.117 fixes the following issues: - CVE-2020-6377: Fixed a use-after-free in audio - Various fixes from internal audits, fuzzing and other initiatives This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-53=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libre2-0-20200101-bp151.6.12.1 libre2-0-debuginfo-20200101-bp151.6.12.1 re2-debugsource-20200101-bp151.6.12.1 re2-devel-20200101-bp151.6.12.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-79.0.3945.117-bp151.3.53.3 chromium-79.0.3945.117-bp151.3.53.3 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libre2-0-64bit-20200101-bp151.6.12.1 libre2-0-64bit-debuginfo-20200101-bp151.6.12.1 References: https://www.suse.com/security/cve/CVE-2019-5844.html https://www.suse.com/security/cve/CVE-2019-5845.html https://www.suse.com/security/cve/CVE-2019-5846.html https://www.suse.com/security/cve/CVE-2020-6377.html https://bugzilla.suse.com/1160337 -- .An update has been released to tackle four security vulnerabilities in Chrome on openSUSE Backports SLE-15-SP1, featuring essential patches for critical issues.. chromium updates, openSUSE security, software fix, backports update. . Severity: Important. LinuxSecurity.com Team
Update to 79.0.3945.117. Fixes CVE-2020-6377.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-581537c8aa 2020-01-13 02:19:21.920243 --------------------------------------------------------------------------------Name : chromium Product : Fedora 31 Version : 79.0.3945.117 Release : 1.fc31 URL : https://www.chromium.org/Home/ Summary : A WebKit (Blink) powered web browser Description : Chromium is an open-source web browser, powered by WebKit (Blink). --------------------------------------------------------------------------------Update Information: Update to 79.0.3945.117. Fixes CVE-2020-6377. --------------------------------------------------------------------------------ChangeLog: * Thu Jan 9 2020 Tom Callaway - 79.0.3945.117-1 - update to 79.0.3945.117 * Tue Dec 17 2019 Tom Callaway - 79.0.3945.88-1 - update to 79.0.3945.88 * Tue Dec 10 2019 Tom Callaway - 79.0.3945.79-1 - update to 79.0.3945.79 * Wed Dec 4 2019 Tom Callaway - 79.0.3945.56-2 - fix lib provides filtering * Tue Dec 3 2019 Tom Callaway - 79.0.3945.56-1 - update to current beta (rawhide only) - switch to upstream patch for clock_nanosleep fix * Mon Nov 25 2019 Tom Callaway - 78.0.3904.108-1 - update to 78.0.3904.108 * Sun Nov 17 2019 Tom Callaway - 78.0.3904.97-2 - allow clock_nanosleep through seccomp (bz #1773289) * Thu Nov 7 2019 Tom Callaway - 78.0.3904.97-1 - update to 78.0.3904.97 * Fri Nov 1 2019 Tom Callaway - 78.0.3904.87-1 - update to 78.0.3904.87 - apply most of the freeworld changes in PR 23/24/25 * Wed Oct 23 2019 Tom Callaway - 78.0.3904.80-1 - update to 78.0.3904.80 * Wed Oct 16 2019 Tom Callaway - 77.0.3865.120-4 - upstream fix for zlib symbol exports with gcc * Wed Oct 16 2019 Tom Callaway - 77.0.3865.120-3 - silence outdated build noise (bz1745745) * Tue Oct 15 2019 Tom Callaway - 77.0.3865.120-2 - fix node handling for EPEL-8 * Mon Oct 14 2019Tomas Popela - 77.0.3865.120-1 - Update to 77.0.3865.120 * Thu Oct 10 2019 Tom Callaway - 77.0.3865.90-4 - enable aarch64 for EPEL-8 * Wed Oct 9 2019 Tom Callaway - 77.0.3865.90-3 - spec cleanups and changes to make EPEL8 try to build --------------------------------------------------------------------------------References: [ 1 ] Bug #1789442 - CVE-2020-6377 chromium: chromium-browser: Use after free in audio [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1789442 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-581537c8aa' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team.. ==================================================================== Red Hat Security Advisory Synopsis: Important: libvorbis security update Advisory ID: RHSA-2008:0270-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2008:0270.html Issue date: 2008-05-14 CVE Names: CVE-2008-1419 CVE-2008-1420 CVE-2008-1423 ==================================================================== 1. Summary: Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format. Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attackercould create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 440700 - CVE-2008-1419 vorbis: zero-dim codebooks can cause crash, infinite loop or heap overflow 440706 - CVE-2008-1420 vorbis: integer overflow in partvals computation 440709 - CVE-2008-1423 vorbis: integer oveflow caused by huge codebooks 6. Package List: Red Hat Enterprise Linux AS version3: Source: i386: libvorbis-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-devel-1.0-10.el3.i386.rpm ia64: libvorbis-1.0-10.el3.i386.rpm libvorbis-1.0-10.el3.ia64.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.ia64.rpm libvorbis-devel-1.0-10.el3.ia64.rpm ppc: libvorbis-1.0-10.el3.ppc.rpm libvorbis-1.0-10.el3.ppc64.rpm libvorbis-debuginfo-1.0-10.el3.ppc.rpm libvorbis-debuginfo-1.0-10.el3.ppc64.rpm libvorbis-devel-1.0-10.el3.ppc.rpm s390: libvorbis-1.0-10.el3.s390.rpm libvorbis-debuginfo-1.0-10.el3.s390.rpm libvorbis-devel-1.0-10.el3.s390.rpm s390x: libvorbis-1.0-10.el3.s390.rpm libvorbis-1.0-10.el3.s390x.rpm libvorbis-debuginfo-1.0-10.el3.s390.rpm libvorbis-debuginfo-1.0-10.el3.s390x.rpm libvorbis-devel-1.0-10.el3.s390x.rpm x86_64: libvorbis-1.0-10.el3.i386.rpm libvorbis-1.0-10.el3.x86_64.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.x86_64.rpm libvorbis-devel-1.0-10.el3.x86_64.rpm Red Hat Desktop version 3: Source: i386: libvorbis-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-devel-1.0-10.el3.i386.rpm x86_64: libvorbis-1.0-10.el3.i386.rpm libvorbis-1.0-10.el3.x86_64.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.x86_64.rpm libvorbis-devel-1.0-10.el3.x86_64.rpm Red Hat Enterprise Linux ES version 3: Source: i386: libvorbis-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-devel-1.0-10.el3.i386.rpm ia64: libvorbis-1.0-10.el3.i386.rpm libvorbis-1.0-10.el3.ia64.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.ia64.rpm libvorbis-devel-1.0-10.el3.ia64.rpm x86_64: libvorbis-1.0-10.el3.i386.rpm libvorbis-1.0-10.el3.x86_64.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.x86_64.rpm libvorbis-devel-1.0-10.el3.x86_64.rpm Red Hat Enterprise Linux WS version3: Source: i386: libvorbis-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-devel-1.0-10.el3.i386.rpm ia64: libvorbis-1.0-10.el3.i386.rpm libvorbis-1.0-10.el3.ia64.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.ia64.rpm libvorbis-devel-1.0-10.el3.ia64.rpm x86_64: libvorbis-1.0-10.el3.i386.rpm libvorbis-1.0-10.el3.x86_64.rpm libvorbis-debuginfo-1.0-10.el3.i386.rpm libvorbis-debuginfo-1.0-10.el3.x86_64.rpm libvorbis-devel-1.0-10.el3.x86_64.rpm Red Hat Enterprise Linux AS version 4: Source: i386: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-devel-1.1.0-3.el4_6.1.i386.rpm ia64: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-1.1.0-3.el4_6.1.ia64.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.ia64.rpm libvorbis-devel-1.1.0-3.el4_6.1.ia64.rpm ppc: libvorbis-1.1.0-3.el4_6.1.ppc.rpm libvorbis-1.1.0-3.el4_6.1.ppc64.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.ppc.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.ppc64.rpm libvorbis-devel-1.1.0-3.el4_6.1.ppc.rpm s390: libvorbis-1.1.0-3.el4_6.1.s390.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.s390.rpm libvorbis-devel-1.1.0-3.el4_6.1.s390.rpm s390x: libvorbis-1.1.0-3.el4_6.1.s390.rpm libvorbis-1.1.0-3.el4_6.1.s390x.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.s390.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.s390x.rpm libvorbis-devel-1.1.0-3.el4_6.1.s390x.rpm x86_64: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-1.1.0-3.el4_6.1.x86_64.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.x86_64.rpm libvorbis-devel-1.1.0-3.el4_6.1.x86_64.rpm Red Hat Enterprise Linux Desktop version4: Source: i386: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-devel-1.1.0-3.el4_6.1.i386.rpm x86_64: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-1.1.0-3.el4_6.1.x86_64.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.x86_64.rpm libvorbis-devel-1.1.0-3.el4_6.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-devel-1.1.0-3.el4_6.1.i386.rpm ia64: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-1.1.0-3.el4_6.1.ia64.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.ia64.rpm libvorbis-devel-1.1.0-3.el4_6.1.ia64.rpm x86_64: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-1.1.0-3.el4_6.1.x86_64.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.x86_64.rpm libvorbis-devel-1.1.0-3.el4_6.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: i386: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-devel-1.1.0-3.el4_6.1.i386.rpm ia64: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-1.1.0-3.el4_6.1.ia64.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.ia64.rpm libvorbis-devel-1.1.0-3.el4_6.1.ia64.rpm x86_64: libvorbis-1.1.0-3.el4_6.1.i386.rpm libvorbis-1.1.0-3.el4_6.1.x86_64.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.i386.rpm libvorbis-debuginfo-1.1.0-3.el4_6.1.x86_64.rpm libvorbis-devel-1.1.0-3.el4_6.1.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: libvorbis-1.1.2-3.el5_1.2.i386.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.i386.rpm x86_64: libvorbis-1.1.2-3.el5_1.2.i386.rpm libvorbis-1.1.2-3.el5_1.2.x86_64.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.i386.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.x86_64.rpm RHEL Desktop Workstation (v. 5client): Source: i386: libvorbis-debuginfo-1.1.2-3.el5_1.2.i386.rpm libvorbis-devel-1.1.2-3.el5_1.2.i386.rpm x86_64: libvorbis-debuginfo-1.1.2-3.el5_1.2.i386.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.x86_64.rpm libvorbis-devel-1.1.2-3.el5_1.2.i386.rpm libvorbis-devel-1.1.2-3.el5_1.2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: libvorbis-1.1.2-3.el5_1.2.i386.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.i386.rpm libvorbis-devel-1.1.2-3.el5_1.2.i386.rpm ia64: libvorbis-1.1.2-3.el5_1.2.ia64.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.ia64.rpm libvorbis-devel-1.1.2-3.el5_1.2.ia64.rpm ppc: libvorbis-1.1.2-3.el5_1.2.ppc.rpm libvorbis-1.1.2-3.el5_1.2.ppc64.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.ppc.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.ppc64.rpm libvorbis-devel-1.1.2-3.el5_1.2.ppc.rpm libvorbis-devel-1.1.2-3.el5_1.2.ppc64.rpm s390x: libvorbis-1.1.2-3.el5_1.2.s390.rpm libvorbis-1.1.2-3.el5_1.2.s390x.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.s390.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.s390x.rpm libvorbis-devel-1.1.2-3.el5_1.2.s390.rpm libvorbis-devel-1.1.2-3.el5_1.2.s390x.rpm x86_64: libvorbis-1.1.2-3.el5_1.2.i386.rpm libvorbis-1.1.2-3.el5_1.2.x86_64.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.i386.rpm libvorbis-debuginfo-1.1.2-3.el5_1.2.x86_64.rpm libvorbis-devel-1.1.2-3.el5_1.2.i386.rpm libvorbis-devel-1.1.2-3.el5_1.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2008-1419 https://www.cve.org/CVERecord?id=CVE-2008-1420 https://www.cve.org/CVERecord?id=CVE-2008-1423 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. . Newly released libvorbis updates address seriousvulnerabilities in Red Hat Enterprise Linux versions 3, 4, and 5. Significant security implications.. libvorbis, Red Hat updates, critical security fix, audio processing issues. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.