libvorbis security update

2008-05-14T12:52:45
ID CESA-2008:0270
Type centos
Reporter CentOS Project
Modified 2008-05-19T01:19:21

Description

CentOS Errata and Security Advisory CESA-2008:0270

The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format.

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423)

Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future.

Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2008-May/026936.html http://lists.centos.org/pipermail/centos-announce/2008-May/026937.html http://lists.centos.org/pipermail/centos-announce/2008-May/026938.html http://lists.centos.org/pipermail/centos-announce/2008-May/026939.html http://lists.centos.org/pipermail/centos-announce/2008-May/026944.html http://lists.centos.org/pipermail/centos-announce/2008-May/026945.html http://lists.centos.org/pipermail/centos-announce/2008-May/026946.html http://lists.centos.org/pipermail/centos-announce/2008-May/026947.html http://lists.centos.org/pipermail/centos-announce/2008-May/026952.html http://lists.centos.org/pipermail/centos-announce/2008-May/026953.html

Affected packages: libvorbis libvorbis-devel

Upstream details at: https://rhn.redhat.com/errata/RHSA-2008-0270.html