[Git][security-tracker-team/security-tracker][master] CVE-2023-34318: fixed by same fix as CVE-2021-23159
Bastien Roucariès (@rouca)
rouca at debian.org
Sun Aug 13 13:52:26 BST 2023
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker
Commits:
55f0616d by Bastien Roucariès at 2023-08-13T12:50:48+00:00
CVE-2023-34318: fixed by same fix as CVE-2021-23159
Tested poc under trixie and gdb tracing.
Fail early (before the location of leak) by:
Implausible dictionary size in HCOM header
Cross tested also under valgrind
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4913,10 +4913,12 @@ CVE-2023-34432 (A heap buffer overflow vulnerability was found in sox, in the ls
CVE-2023-34347 (Delta Electronics InfraSuite Device Master versions prior to 1.0.7 con ...)
NOT-FOR-US: Delta Electronics InfraSuite Device Master
CVE-2023-34318 (A heap buffer overflow vulnerability was found in sox, in the startrea ...)
- - sox <unfixed> (bug #1041111)
+ - sox 14.4.2+git20190427-3.2 (bug #1041111)
+ [bullseye] - sox 14.4.2+git20190427-2+deb11u1
+ [buster] - sox 14.4.2+git20190427-1+deb10u1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2212283
NOTE: https://sourceforge.net/p/sox/bugs/368/
- TODO: check, might be fixed along with the fix for CVE-2021-23159
+ NOTE: Same fix as for CVE-2021-23159
CVE-2023-34316 (An attacker could bypass the latest Delta Electronics InfraSuite Devic ...)
NOT-FOR-US: Delta Electronics InfraSuite Device Master
CVE-2023-32627 (A floating point exception vulnerability was found in sox, in the read ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55f0616d8f1b2e3f83bc218676943dc1a65b2d34
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55f0616d8f1b2e3f83bc218676943dc1a65b2d34
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230813/d185026c/attachment.htm>
More information about the debian-security-tracker-commits
mailing list