Bug#876682: libsndfile: CVE-2017-14245, CVE-2017-14246

[Markus Koschany]

Package: libsndfile
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

the following vulnerabilities were published for libsndfile.

CVE-2017-14245[0]:
| An out of bounds read in the function d2alaw_array() in alaw.c of
| libsndfile 1.0.28 may lead to a remote DoS attack or information
| disclosure, related to mishandling of the NAN and INFINITY
| floating-point values.

CVE-2017-14246[1]:
| An out of bounds read in the function d2ulaw_array() in ulaw.c of
| libsndfile 1.0.28 may lead to a remote DoS attack or information
| disclosure, related to mishandling of the NAN and INFINITY
| floating-point values.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-14245
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14245
[1] https://security-tracker.debian.org/tracker/CVE-2017-14246
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14246

Please adjust the affected versions in the BTS as needed.

Regards,

Markus

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/attachments/20170924/63cbcf55/attachment.sig>