[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Update libmad status

[Kurt Roeckx]

Kurt Roeckx pushed to branch master at Debian Security Tracker / security-tracker


Commits:
558a77a1 by Kurt Roeckx at 2018-01-28T23:37:46+01:00
Update libmad status

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -42464,18 +42464,18 @@ CVE-2017-8376 (GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that
 CVE-2017-8375
 	RESERVED
 CVE-2017-8374 (The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b ...)
-	- libmad 0.15.1b-4
-	NOTE: Addressed by patch from #508133
+	- libmad 0.15.1b-9
+	NOTE: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c/
+	NOTE: The patch from #508133 fixed things related to this, but did not fix this.
 CVE-2017-8373 (The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b ...)
 	- libmad 0.15.1b-9 (bug #287519)
-	NOTE: Addressed/Covered by patch from #508133
-	NOTE: The patch applied in 0.15.1b-4 only covered the actual issue
+	NOTE: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_layer_iii-layer3-c/
+	NOTE: The patch from #508133 applied in 0.15.1b-4 only partially fixed it
 	NOTE: "Duplicate with"/basically same as CVE-2017-8372
 CVE-2017-8372 (The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, ...)
 	- libmad 0.15.1b-9 (bug #287519)
 	NOTE: https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c/
-	NOTE: Addressed/Covered by patch from #508133
-	NOTE: The patch applied in 0.15.1b-4 only covered the actual issue
+	NOTE: The patch from #508133 applied in 0.15.1b-4 only partially fixed it
 	NOTE: "Duplicate" with/basically same as CVE-2017-8373
 CVE-2017-8371 (Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses ...)
 	NOT-FOR-US: Schneider Electric



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/558a77a1921183831297dd97c8eeac073431a7d5

---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/558a77a1921183831297dd97c8eeac073431a7d5
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180128/20614628/attachment.html>