Security update for libsndfile SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1030-1 Final 1 1 2017-04-18T06:42:29Z current 2017-04-18T06:42:29Z 2017-04-18T06:42:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libsndfile This update for libsndfile fixes the following issues: - CVE-2017-7585,CVE-2017-7741,CVE-2017-7742: Some stack-based buffer overflows via a specially crafted FLAC file were fixed (error in the 'flac_buffer_copy()' function) (bsc#1033054, bsc#1033914, bsc#1033915). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-libsndfile-13064,slessp4-libsndfile-13064 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171030-1/ Link for SUSE-SU-2017:1030-1 https://lists.suse.com/pipermail/sle-security-updates/2017-April/002804.html E-Mail link for SUSE-SU-2017:1030-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1033054 SUSE Bug 1033054 https://bugzilla.suse.com/1033914 SUSE Bug 1033914 https://bugzilla.suse.com/1033915 SUSE Bug 1033915 https://www.suse.com/security/cve/CVE-2017-7585/ SUSE CVE CVE-2017-7585 page https://www.suse.com/security/cve/CVE-2017-7741/ SUSE CVE CVE-2017-7741 page https://www.suse.com/security/cve/CVE-2017-7742/ SUSE CVE CVE-2017-7742 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libsndfile-devel-1.0.20-2.13.1 libsndfile-1.0.20-2.13.1 libsndfile-32bit-1.0.20-2.13.1 libsndfile-x86-1.0.20-2.13.1 libsndfile-1.0.20-2.13.1 as a component of SUSE Linux Enterprise Server 11 SP4 libsndfile-32bit-1.0.20-2.13.1 as a component of SUSE Linux Enterprise Server 11 SP4 libsndfile-x86-1.0.20-2.13.1 as a component of SUSE Linux Enterprise Server 11 SP4 libsndfile-1.0.20-2.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libsndfile-32bit-1.0.20-2.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libsndfile-x86-1.0.20-2.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libsndfile-devel-1.0.20-2.13.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. CVE-2017-7585 SUSE Linux Enterprise Server 11 SP4:libsndfile-1.0.20-2.13.1 SUSE Linux Enterprise Server 11 SP4:libsndfile-32bit-1.0.20-2.13.1 SUSE Linux Enterprise Server 11 SP4:libsndfile-x86-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-32bit-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-x86-1.0.20-2.13.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libsndfile-devel-1.0.20-2.13.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171030-1/ https://www.suse.com/security/cve/CVE-2017-7585.html CVE-2017-7585 https://bugzilla.suse.com/1033054 SUSE Bug 1033054 https://bugzilla.suse.com/1033914 SUSE Bug 1033914 https://bugzilla.suse.com/1033915 SUSE Bug 1033915 In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585. CVE-2017-7741 SUSE Linux Enterprise Server 11 SP4:libsndfile-1.0.20-2.13.1 SUSE Linux Enterprise Server 11 SP4:libsndfile-32bit-1.0.20-2.13.1 SUSE Linux Enterprise Server 11 SP4:libsndfile-x86-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-32bit-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-x86-1.0.20-2.13.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libsndfile-devel-1.0.20-2.13.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171030-1/ https://www.suse.com/security/cve/CVE-2017-7741.html CVE-2017-7741 https://bugzilla.suse.com/1033054 SUSE Bug 1033054 https://bugzilla.suse.com/1033915 SUSE Bug 1033915 In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585. CVE-2017-7742 SUSE Linux Enterprise Server 11 SP4:libsndfile-1.0.20-2.13.1 SUSE Linux Enterprise Server 11 SP4:libsndfile-32bit-1.0.20-2.13.1 SUSE Linux Enterprise Server 11 SP4:libsndfile-x86-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-32bit-1.0.20-2.13.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libsndfile-x86-1.0.20-2.13.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libsndfile-devel-1.0.20-2.13.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171030-1/ https://www.suse.com/security/cve/CVE-2017-7742.html CVE-2017-7742 https://bugzilla.suse.com/1033054 SUSE Bug 1033054 https://bugzilla.suse.com/1033914 SUSE Bug 1033914