ALT-PU-2016-2286-1
Package libsndfile updated to version 1.0.27-alt1 for branch sisyphus in task 172211.
Closed vulnerabilities
Published: 2015-01-16
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2014-9496
The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
Severity: LOW (2.1)
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
- http://advisories.mageia.org/MGASA-2015-0015.html
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00016.html
- http://secunia.com/advisories/62320
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:024
- http://www.openwall.com/lists/oss-security/2015/01/04/4
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.securityfocus.com/bid/71796
- http://www.ubuntu.com/usn/USN-2832-1
- https://github.com/erikd/libsndfile/commit/dbe14f00030af5d3577f4cabbf9861db59e9c378
- https://github.com/erikd/libsndfile/issues/93
- https://seclists.org/bugtraq/2019/Apr/23
- https://security.gentoo.org/glsa/201612-03
- http://advisories.mageia.org/MGASA-2015-0015.html
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00016.html
- http://secunia.com/advisories/62320
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:024
- http://www.openwall.com/lists/oss-security/2015/01/04/4
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.securityfocus.com/bid/71796
- http://www.ubuntu.com/usn/USN-2832-1
- https://github.com/erikd/libsndfile/commit/dbe14f00030af5d3577f4cabbf9861db59e9c378
- https://github.com/erikd/libsndfile/issues/93
- https://seclists.org/bugtraq/2019/Apr/23
- https://security.gentoo.org/glsa/201612-03
Published: 2015-11-19
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2014-9756
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00077.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00145.html
- http://www.openwall.com/lists/oss-security/2014/12/24/3
- http://www.openwall.com/lists/oss-security/2015/11/03/9
- http://www.ubuntu.com/usn/USN-2832-1
- https://github.com/erikd/libsndfile/commit/725c7dbb95bfaf8b4bb7b04820e3a00cceea9ce6
- https://github.com/erikd/libsndfile/issues/92
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00077.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00145.html
- http://www.openwall.com/lists/oss-security/2014/12/24/3
- http://www.openwall.com/lists/oss-security/2015/11/03/9
- http://www.ubuntu.com/usn/USN-2832-1
- https://github.com/erikd/libsndfile/commit/725c7dbb95bfaf8b4bb7b04820e3a00cceea9ce6
- https://github.com/erikd/libsndfile/issues/92
Published: 2015-11-17
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-7805
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
Severity: CRITICAL (9.3)
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171466.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172593.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172607.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00077.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00145.html
- http://packetstormsecurity.com/files/133926/libsndfile-1.0.25-Heap-Overflow.html
- http://www.nemux.org/2015/10/13/libsndfile-1-0-25-heap-overflow/
- http://www.openwall.com/lists/oss-security/2015/11/03/3
- http://www.openwall.com/lists/oss-security/2015/11/03/7
- http://www.securityfocus.com/bid/77427
- http://www.ubuntu.com/usn/USN-2832-1
- https://security.gentoo.org/glsa/201612-03
- https://www.exploit-db.com/exploits/38447/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171466.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172593.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172607.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00077.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00145.html
- http://packetstormsecurity.com/files/133926/libsndfile-1.0.25-Heap-Overflow.html
- http://www.nemux.org/2015/10/13/libsndfile-1-0-25-heap-overflow/
- http://www.openwall.com/lists/oss-security/2015/11/03/3
- http://www.openwall.com/lists/oss-security/2015/11/03/7
- http://www.securityfocus.com/bid/77427
- http://www.ubuntu.com/usn/USN-2832-1
- https://security.gentoo.org/glsa/201612-03
- https://www.exploit-db.com/exploits/38447/
Published: 2017-11-25
Modified: 2025-04-20
Modified: 2025-04-20
CVE-2017-16942
In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead to DoS when playing a crafted audio file.
Severity: MEDIUM (4.3)
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Severity: MEDIUM (6.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References: