Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
202
security advisorybuffer overflowmemory safetyopenSUSE Leap 42.3: Important Security Update for Lame: Heap Overflow
An update that fixes 12 vulnerabilities is now available.. openSUSE Security Update: Security update for lame ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0544-1 Rating: important References: #1082311 #1082317 #1082333 #1082340 #1082391 #1082392 #1082393 #1082395 #1082397 #1082399 #1082400 #1082401 Cross-References: CVE-2015-9100 CVE-2015-9101 CVE-2017-11720 CVE-2017-13712 CVE-2017-15019 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-9869 CVE-2017-9870 CVE-2017-9871 CVE-2017-9872 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for lame fixes the following issues: Lame was updated to version 3.100: * Improved detection of MPEG audio data in RIFF WAVE files. sf#3545112 Invalid sampling detection * New switch --gain , range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the use of --scale . * Fix for sf#3558466 Bug in path handling * Fix for sf#3567844 problem with Tag genre * Fix for sf#3565659 no progress indication with pipe input * Fix for sf#3544957 scale (empty) silent encode without warning * Fix for sf#3580176 environment variable LAMEOPT doesn't work anymore * Fix for sf#3608583 input file name displayed with wrong character encoding (on windows console with CP_UTF8) * Fix dereference NULL and Buffer not NULL terminated issues. (CVE-2017-15019 bsc#1082317 CVE-2017-13712 bsc#1082399 CVE-2015-9100 bsc#1082401) * Fix dereference of a null pointer possible in loop. * Make sure functions with SSE instructions maintain their own properly aligned stack. Thanks to FabianGreffrath * Multiple Stack and Heap Corruptions from Malicious File. (CVE-2017-9872 bsc#1082391 CVE-2017-9871 bsc#1082392 CVE-2017-9870 bsc#1082393 CVE-2017-9869 bsc#1082395 CVE-2017-9411 bsc#1082397 CVE-2015-9101 bsc#1082400) * CVE-2017-11720: Fix a division by zero vulnerability. (bsc#1082311) * CVE-2017-9410: Fix fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap (bsc#1082333) * CVE-2017-9411: Fix fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash (bsc#1082397) * CVE-2017-9412: FIx unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash (bsc#1082340) * Fix clip detect scale suggestion unaware of scale input value * HIP decoder bug fixed: decoding mixed blocks of lower sample frequency Layer3 data resulted in internal buffer overflow. * Add lame_encode_buffer_interleaved_int() Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-214=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): lame-3.100-7.1 lame-debuginfo-3.100-7.1 lame-debugsource-3.100-7.1 lame-doc-3.100-7.1 lame-mp3rtp-3.100-7.1 lame-mp3rtp-debuginfo-3.100-7.1 libmp3lame-devel-3.100-7.1 libmp3lame0-3.100-7.1 libmp3lame0-debuginfo-3.100-7.1 - openSUSE Leap 42.3 (x86_64): libmp3lame0-32bit-3.100-7.1 libmp3lame0-debuginfo-32bit-3.100-7.1 References: https://www.suse.com/security/cve/CVE-2015-9100.html https://www.suse.com/security/cve/CVE-2015-9101.html https://www.suse.com/security/cve/CVE-2017-11720.html https://www.suse.com/security/cve/CVE-2017-13712.html https://www.suse.com/security/cve/CVE-2017-15019.html https://www.suse.com/security/cve/CVE-2017-9410.html https://www.suse.com/security/cve/CVE-2017-9411.html https://www.suse.com/security/cve/CVE-2017-9412.html https://www.suse.com/security/cve/CVE-2017-9869.html https://www.suse.com/security/cve/CVE-2017-9870.html https://www.suse.com/security/cve/CVE-2017-9871.html https://www.suse.com/security/cve/CVE-2017-9872.html https://bugzilla.suse.com/1082311 https://bugzilla.suse.com/1082317 https://bugzilla.suse.com/1082333 https://bugzilla.suse.com/1082340 https://bugzilla.suse.com/1082391 https://bugzilla.suse.com/1082392 https://bugzilla.suse.com/1082393 https://bugzilla.suse.com/1082395 https://bugzilla.suse.com/1082397 https://bugzilla.suse.com/1082399 https://bugzilla.suse.com/1082400 https://bugzilla.suse.com/1082401 -- . This release for Fedora tackles significant vulnerabilities in libjpeg, enhancing both security measures and overall performance within the environment.. openSUSE Security Update,lame update,buffer overflow fix,memory safety. . Severity: Important. LinuxSecurity.com Team
Feb 26, 2018
•Important
OpenSUSE
202
security advisoryupdatebuffer overflowopenSUSE: 2018:0543-1 Important: Lame Buffer Overflow Fix
An update that fixes 12 vulnerabilities is now available.. openSUSE Security Update: Security update for lame ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0543-1 Rating: important References: #1082311 #1082317 #1082333 #1082340 #1082391 #1082392 #1082393 #1082395 #1082397 #1082399 #1082400 #1082401 Cross-References: CVE-2015-9100 CVE-2015-9101 CVE-2017-11720 CVE-2017-13712 CVE-2017-15019 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-9869 CVE-2017-9870 CVE-2017-9871 CVE-2017-9872 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for lame fixes the following issues: Lame was updated to version 3.100: * Improved detection of MPEG audio data in RIFF WAVE files. sf#3545112 Invalid sampling detection * New switch --gain , range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the use of --scale . * Fix for sf#3558466 Bug in path handling * Fix for sf#3567844 problem with Tag genre * Fix for sf#3565659 no progress indication with pipe input * Fix for sf#3544957 scale (empty) silent encode without warning * Fix for sf#3580176 environment variable LAMEOPT doesn't work anymore * Fix for sf#3608583 input file name displayed with wrong character encoding (on windows console with CP_UTF8) * Fix dereference NULL and Buffer not NULL terminated issues. (CVE-2017-15019 bsc#1082317 CVE-2017-13712 bsc#1082399 CVE-2015-9100 bsc#1082401) * Fix dereference of a null pointer possible in loop. * Make sure functions with SSE instructions maintain their own properly aligned stack. Thanks to Fabian Greffrath * Multiple Stack and Heap Corruptions from Malicious File. (CVE-2017-9872 bsc#1082391 CVE-2017-9871 bsc#1082392 CVE-2017-9870 bsc#1082393 CVE-2017-9869 bsc#1082395 CVE-2017-9411 bsc#1082397 CVE-2015-9101 bsc#1082400) * CVE-2017-11720: Fix a division by zero vulnerability. (bsc#1082311) * CVE-2017-9410: Fix fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap (bsc#1082333) * CVE-2017-9411: Fix fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash (bsc#1082397) * CVE-2017-9412: FIx unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash (bsc#1082340) * Fix clip detect scale suggestion unaware of scale input value * HIP decoder bug fixed: decoding mixed blocks of lower sample frequency Layer3 data resulted in internal buffer overflow. * Add lame_encode_buffer_interleaved_int() Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-214=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): lame-3.100-6.1 lame-debuginfo-3.100-6.1 lame-debugsource-3.100-6.1 lame-doc-3.100-6.1 lame-mp3rtp-3.100-6.1 lame-mp3rtp-debuginfo-3.100-6.1 libmp3lame-devel-3.100-6.1 libmp3lame0-3.100-6.1 libmp3lame0-debuginfo-3.100-6.1 References: https://www.suse.com/security/cve/CVE-2015-9100.html https://www.suse.com/security/cve/CVE-2015-9101.html https://www.suse.com/security/cve/CVE-2017-11720.html https://www.suse.com/security/cve/CVE-2017-13712.html https://www.suse.com/security/cve/CVE-2017-15019.html https://www.suse.com/security/cve/CVE-2017-9410.html https://www.suse.com/security/cve/CVE-2017-9411.html https://www.suse.com/security/cve/CVE-2017-9412.html https://www.suse.com/security/cve/CVE-2017-9869.html https://www.suse.com/security/cve/CVE-2017-9870.html https://www.suse.com/security/cve/CVE-2017-9871.html https://www.suse.com/security/cve/CVE-2017-9872.html https://bugzilla.suse.com/1082311 https://bugzilla.suse.com/1082317 https://bugzilla.suse.com/1082333 https://bugzilla.suse.com/1082340 https://bugzilla.suse.com/1082391 https://bugzilla.suse.com/1082392 https://bugzilla.suse.com/1082393 https://bugzilla.suse.com/1082395 https://bugzilla.suse.com/1082397 https://bugzilla.suse.com/1082399 https://bugzilla.suse.com/1082400 https://bugzilla.suse.com/1082401 -- . Safety patch for vulnerable points tackles several threats, incorporating crucial remedies for buffer overflow and memory concerns.. openSUSE,Lame,Security Update,Buffer Overflow,Memory Issues. . Severity: Important. LinuxSecurity.com Team
Feb 26, 2018
•Important
OpenSUSE
89
security advisoryfedoraupdateFedora 27 LAME Update: 2017-2e2dc86bc6 Critical Security Fixes
Update to 3.100 (#1470202, #1505107). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-2e2dc86bc6 2017-11-11 13:29:22.448255 --------------------------------------------------------------------------------Name : lame Product : Fedora 27 Version : 3.100 Release : 1.fc27 URL : https://lame.sourceforge.io/ Summary : Free MP3 audio compressor Description : LAME is an open source MP3 encoder whose quality and speed matches commercial encoders. LAME handles MPEG1,2 and 2.5 layer III encoding with both constant and variable bitrates. --------------------------------------------------------------------------------Update Information: Update to 3.100 (#1470202, #1505107) --------------------------------------------------------------------------------References: [ 1 ] Bug #1470202 - CVE-2015-9099 CVE-2015-9100 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-8419 lame: Multiple vulnerabilities [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1470202 [ 2 ] Bug #1505107 - LAME 3.100 update with security fixes https://bugzilla.redhat.com/show_bug.cgi?id=1505107 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade lame' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Nov 11, 2017
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!