[Git][security-tracker-team/security-tracker][master] Reserve DLA-4402-1 for libsndfile

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
fa3bfb8b by Bastien Roucariès at 2025-12-11T12:32:42+01:00
Reserve DLA-4402-1 for libsndfile

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -361963,7 +361963,6 @@ CVE-2021-4157 (An out of memory bounds write flaw (1 or 2 bytes of memory) in th
 CVE-2021-4156 (An out-of-bounds read flaw was found in libsndfile's FLAC codec functi ...)
 	{DLA-3126-1 DLA-3058-1}
 	- libsndfile 1.1.0-1 (bug #1014713)
-	[bullseye] - libsndfile <no-dsa> (Minor issue)
 	NOTE: https://github.com/libsndfile/libsndfile/issues/731
 	NOTE: https://github.com/libsndfile/libsndfile/commit/ced91d7b971be6173b604154c39279ce90ad87cc (1.1.0beta1)
 CVE-2021-4155 (A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS ...)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[11 Dec 2025] DLA-4402-1 libsndfile - security update
+	{CVE-2021-4156}
+	[bullseye] - libsndfile 1.0.31-2+deb11u2
 [11 Dec 2025] DLA-4401-1 firefox-esr - security update
 	{CVE-2025-14321 CVE-2025-14322 CVE-2025-14323 CVE-2025-14324 CVE-2025-14325 CVE-2025-14328 CVE-2025-14329 CVE-2025-14330 CVE-2025-14331 CVE-2025-14333}
 	[bullseye] - firefox-esr 140.6.0esr-1~deb11u1


=====================================
data/dla-needed.txt
=====================================
@@ -195,10 +195,6 @@ libgd2 (guilhem)
   NOTE: 20251130: Fix CVE-2021-40812/CVE-2021-38115 regression from upgrade from buster (rouca)
   NOTE: 20251130: Check also CVE in libwmf embed copy of libgd2. (rouca)
 --
-libsndfile (rouca)
-  NOTE: 20251206: Added by Front-Desk (rouca)
-  NOTE: 20251206: Closes CVE-2021-4156 fixed in buster (rouca/front-desk)
---
 libsoup2.4
   NOTE: 20250408: Added by Front-Desk (Beuc)
   NOTE: 20250427: libsoup2.4 2.72.0-2+deb11u2 (bullseye) uploaded ...



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fa3bfb8bd6055fd0fbae80d07378033aed574f89

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fa3bfb8bd6055fd0fbae80d07378033aed574f89
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20251211/df2be48b/attachment-0001.htm>