[Git][security-tracker-team/security-tracker][master] libsndfile: add fix for alaw and ulaw issues

[Hugo Lefeuvre]

Hugo Lefeuvre pushed to branch master at Debian Security Tracker / security-tracker


Commits:
504636b8 by Hugo Lefeuvre at 2018-12-24T10:37:40Z
libsndfile: add fix for alaw and ulaw issues

This fix addresses CVE-2018-19661, CVE-2018-19662, CVE-2017-17456 and
CVE-2017-17457.

CVE-2017-14245 and CVE-2017-14246 are fixed as well since they are
duplicates of CVE-2017-17456 and CVE-2017-17457.

I have already asked for rejection when appropriate but didn't get any
answer from the mitre team yet.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5792,11 +5792,13 @@ CVE-2018-19662 (An issue was discovered in libsndfile 1.0.28. There is a buffer
 	- libsndfile <unfixed> (low)
 	[stretch] - libsndfile <no-dsa> (Minor issue)
 	NOTE: https://github.com/erikd/libsndfile/issues/429
+	NOTE: https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
 	NOTE: similar to CVE-2017-17456/CVE-2017-17457 (but not duplicate)
 CVE-2018-19661 (An issue was discovered in libsndfile 1.0.28. There is a buffer ...)
 	- libsndfile <unfixed> (low)
 	[stretch] - libsndfile <no-dsa> (Minor issue)
 	NOTE: https://github.com/erikd/libsndfile/issues/429
+	NOTE: https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
 	NOTE: similar to CVE-2017-17456/CVE-2017-17457 (but not duplicate)
 CVE-2018-19660 (An exploitable authenticated command-injection vulnerability exists in ...)
 	NOT-FOR-US: Moxa
@@ -58987,6 +58989,7 @@ CVE-2017-17457 (The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 m
 	[jessie] - libsndfile <no-dsa> (Minor issue)
 	[wheezy] - libsndfile <no-dsa> (Minor issue)
 	NOTE: https://github.com/erikd/libsndfile/issues/344
+	NOTE: https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
 	NOTE: Might be a duplicate of CVE-2017-14245/CVE-2017-14246
 CVE-2017-17456 (The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead ...)
 	- libsndfile <unfixed> (low; bug #884735)
@@ -58994,6 +58997,7 @@ CVE-2017-17456 (The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 m
 	[jessie] - libsndfile <no-dsa> (Minor issue)
 	[wheezy] - libsndfile <no-dsa> (Minor issue)
 	NOTE: https://github.com/erikd/libsndfile/issues/344
+	NOTE: https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
 	NOTE: Might be a duplicate of CVE-2017-14245/CVE-2017-14246
 CVE-2017-17455 (Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before ...)
 	- mahara <removed>
@@ -71766,12 +71770,14 @@ CVE-2017-14246 (An out of bounds read in the function d2ulaw_array() in ulaw.c o
 	[jessie] - libsndfile <no-dsa> (Minor issue)
 	[wheezy] - libsndfile <no-dsa> (Minor issue)
 	NOTE: https://github.com/erikd/libsndfile/issues/317
+	NOTE: https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
 CVE-2017-14245 (An out of bounds read in the function d2alaw_array() in alaw.c of ...)
 	- libsndfile <unfixed> (low; bug #876682)
 	[stretch] - libsndfile <no-dsa> (Minor issue)
 	[jessie] - libsndfile <no-dsa> (Minor issue)
 	[wheezy] - libsndfile <no-dsa> (Minor issue)
 	NOTE: https://github.com/erikd/libsndfile/issues/317
+	NOTE: https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f
 CVE-2017-14244 (An authentication bypass vulnerability on iBall Baton ADSL2+ Home ...)
 	NOT-FOR-US: iBall
 CVE-2017-14243 (An authentication bypass vulnerability on UTStar WA3002G4 ADSL ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/504636b8acf2e1499edeb41fab206da54417579c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/504636b8acf2e1499edeb41fab206da54417579c
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181224/792f9d32/attachment.html>