[SECURITY] [DLA 1049-1] libsndfile security update

2017-08-0712:29:17

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

77.1%

JSON

Package : libsndfile
Version : 1.0.25-9.1+deb7u4
CVE ID : CVE-2017-12562
Debian Bug : #869166

It was discovered that there was a heap buffer overflow attack in libsndfile, a
library for reading/writing audio files. An attacker could cause a remote
denial of service attack by tricking the function into outputting a large
amount of data.

For Debian 7 "Wheezy", this issue has been fixed in libsndfile version
1.0.25-9.1+deb7u4.

We recommend that you upgrade your libsndfile packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb, Debian Project Leader
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian9arm64libsndfile1-dbg< 1.0.27-3+deb9u3libsndfile1-dbg_1.0.27-3+deb9u3_arm64.deb
Debian9arm64libsndfile1< 1.0.27-3+deb9u3libsndfile1_1.0.27-3+deb9u3_arm64.deb
Debian9amd64libsndfile1-dbg< 1.0.27-3+deb9u3libsndfile1-dbg_1.0.27-3+deb9u3_amd64.deb
Debian7armelsndfile-programs< 1.0.25-9.1+deb7u4sndfile-programs_1.0.25-9.1+deb7u4_armel.deb
Debian9arm64libsndfile1-dev< 1.0.27-3+deb9u3libsndfile1-dev_1.0.27-3+deb9u3_arm64.deb
Debian9armelsndfile-programs-dbg< 1.0.27-3+deb9u3sndfile-programs-dbg_1.0.27-3+deb9u3_armel.deb
Debian7i386sndfile-programs< 1.0.25-9.1+deb7u4sndfile-programs_1.0.25-9.1+deb7u4_i386.deb
Debian9armhflibsndfile1-dev< 1.0.27-3+deb9u3libsndfile1-dev_1.0.27-3+deb9u3_armhf.deb
Debian9i386libsndfile1-dev< 1.0.27-3+deb9u3libsndfile1-dev_1.0.27-3+deb9u3_i386.deb
Debian7armellibsndfile1-dev< 1.0.25-9.1+deb7u4libsndfile1-dev_1.0.25-9.1+deb7u4_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	libsndfile1-dbg	< 1.0.27-3+deb9u3	libsndfile1-dbg_1.0.27-3+deb9u3_arm64.deb
Debian	9	arm64	libsndfile1	< 1.0.27-3+deb9u3	libsndfile1_1.0.27-3+deb9u3_arm64.deb
Debian	9	amd64	libsndfile1-dbg	< 1.0.27-3+deb9u3	libsndfile1-dbg_1.0.27-3+deb9u3_amd64.deb
Debian	7	armel	sndfile-programs	< 1.0.25-9.1+deb7u4	sndfile-programs_1.0.25-9.1+deb7u4_armel.deb
Debian	9	arm64	libsndfile1-dev	< 1.0.27-3+deb9u3	libsndfile1-dev_1.0.27-3+deb9u3_arm64.deb
Debian	9	armel	sndfile-programs-dbg	< 1.0.27-3+deb9u3	sndfile-programs-dbg_1.0.27-3+deb9u3_armel.deb
Debian	7	i386	sndfile-programs	< 1.0.25-9.1+deb7u4	sndfile-programs_1.0.25-9.1+deb7u4_i386.deb
Debian	9	armhf	libsndfile1-dev	< 1.0.27-3+deb9u3	libsndfile1-dev_1.0.27-3+deb9u3_armhf.deb
Debian	9	i386	libsndfile1-dev	< 1.0.27-3+deb9u3	libsndfile1-dev_1.0.27-3+deb9u3_i386.deb
Debian	7	armel	libsndfile1-dev	< 1.0.25-9.1+deb7u4	libsndfile1-dev_1.0.25-9.1+deb7u4_armel.deb