SUSE-SU-2025:1450-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2025-22921: Clear array length when freeing it. bsc1237382 - CVE-2025-0518: Fix memory data leak when use sscanf. bsc1236007 - CVE-2025-22919: Check for valid sample rate, to fix the invalid sample rate = 0. bsc1237371 - CVE-2024-12361: Add...

anything-llm 资源管理错误漏洞

anything-llm is an all-in-one desktop and Docker AI application open-sourced by Mintplex. A resource management error vulnerability exists in anything-llm, which stems from the fact that uploading low-sample-rate audio files may cause a site instance to crash...

PT-2025-12191 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm version 1d9452da2b92 Description: A denial of service issue arises when uploading an audio file with a very low sample rate, causing the site instance to crash. This occurs due to the localWhisper implementation,...

[SECURITY] Fedora 41 Update: SDL2_sound-2.0.4-1.fc41

SDLsound is a library that handles the decoding of several popular sound file formats, such as .WAV and .OGG. It is meant to make the programmer's sound playback tasks simpler. The programmer gives SDLsound a filename, or feeds it data directly from one of many sources, and then reads the decoded...

The vulnerability of the USB-Audio component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the USB-Audio component in the Linux operating system’s kernel is related to the assignment of the NULL pointer in the function sndusbsetsampleratev2v3. Exploiting this vulnerability can allow an attacker to cause a service failure...

ffmpeg:ffmpeg_SWR_fuzzer: Use-of-uninitialized-value in swri_rematrix

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4905557943713792 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegSWRfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Ubuntu 18.04 LTS : WavPack vulnerability (USN-3960-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3960-1 advisory. It was discovered that WavPack incorrectly handled certain DFF files. An attacker could possibly use this issue to cause a denial of service. Tenable has extracte...

SUSE CVE-2012-1107

The analyzeCurrent function in ape/apeproperties.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service application crash via a crafted sampleRate in an ape file, which triggers a divide-by-zero error...

SUSE CVE-2014-1542

Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate...

SUSE CVE-2015-9099

The lameinitparams function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service invalid read and application crash via a crafted audio file with a negative sample rate...

SUSE CVE-2017-18255

The perfcputimemaxpercenthandler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service integer overflow or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation...

SUSE CVE-2018-19840

The function WavpackPackInit in packutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service resource exhaustion caused by an infinite loop via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero...

SUSE CVE-2019-11498

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

SUSE CVE-2022-35995

TensorFlow is an open source platform for machine learning. When AudioSummaryV2 receives an input samplerate with more than one element, it gives a CHECK fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit...

CVE-2022-35995

TensorFlow is an open source platform for machine learning. When AudioSummaryV2 receives an input samplerate with more than one element, it gives a CHECK fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit...

GHSA-G9H5-VR8M-X2H4 TensorFlow vulnerable to `CHECK` fail in `AudioSummaryV2`

Impact When AudioSummaryV2 receives an input samplerate with more than one element, it gives a CHECK fails that can be used to trigger a denial of service attack. python import tensorflow as tf arg0='' arg1=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=None arg2=tf.random.uniformshape=2,1,...

Out-Of-Bound Reads

Wavpack is vulnerable to out-of-bound reads. The vulnerability exists in WavpackPackSamples function of file src/packutils.cwhich allows an attacker to create a malformed WAV file with a high sample rate which causes a head out of bounds error crashing the program...

[SECURITY] [DLA 2845-1] libsamplerate security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2845-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz December 14, 2021 https://wiki.debian.org/LTS -...

CVE-2021-25384

An improper input validation vulnerability in sdfffdparsechunkPROP with Sample Rate Chunk in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process...

CVE-2021-25384

An improper input validation vulnerability in sdfffdparsechunkPROP with Sample Rate Chunk in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process...