Security update for libsndfile SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1040-1 Final 1 1 2017-04-18T09:20:38Z current 2017-04-18T09:20:38Z 2017-04-18T09:20:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libsndfile This update for libsndfile fixes the following security issues: - CVE-2017-7586: A stack-based buffer overflow via a specially crafted FLAC file was fixed (error in the 'header_read()' function) (bsc#1033053) - CVE-2017-7585,CVE-2017-7741, CVE-2017-7742: Several stack-based buffer overflows via a specially crafted FLAC file (error in the 'flac_buffer_copy()' function) were fixed (bsc#1033054,bsc#1033915,bsc#1033914). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2017-607,SUSE-SLE-DESKTOP-12-SP2-2017-607,SUSE-SLE-RPI-12-SP2-2017-607,SUSE-SLE-SDK-12-SP1-2017-607,SUSE-SLE-SDK-12-SP2-2017-607,SUSE-SLE-SERVER-12-SP1-2017-607,SUSE-SLE-SERVER-12-SP2-2017-607 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171040-1/ Link for SUSE-SU-2017:1040-1 https://lists.suse.com/pipermail/sle-security-updates/2017-April/002806.html E-Mail link for SUSE-SU-2017:1040-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1033053 SUSE Bug 1033053 https://bugzilla.suse.com/1033054 SUSE Bug 1033054 https://bugzilla.suse.com/1033914 SUSE Bug 1033914 https://bugzilla.suse.com/1033915 SUSE Bug 1033915 https://www.suse.com/security/cve/CVE-2017-7585/ SUSE CVE CVE-2017-7585 page https://www.suse.com/security/cve/CVE-2017-7586/ SUSE CVE CVE-2017-7586 page https://www.suse.com/security/cve/CVE-2017-7741/ SUSE CVE CVE-2017-7741 page https://www.suse.com/security/cve/CVE-2017-7742/ SUSE CVE CVE-2017-7742 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 libsndfile1-1.0.25-28.1 libsndfile1-32bit-1.0.25-28.1 libsndfile-devel-1.0.25-28.1 libsndfile1-1.0.25-28.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libsndfile1-32bit-1.0.25-28.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libsndfile1-1.0.25-28.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libsndfile1-32bit-1.0.25-28.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libsndfile1-1.0.25-28.1 as a component of SUSE Linux Enterprise Server 12 SP1 libsndfile1-32bit-1.0.25-28.1 as a component of SUSE Linux Enterprise Server 12 SP1 libsndfile1-1.0.25-28.1 as a component of SUSE Linux Enterprise Server 12 SP2 libsndfile1-32bit-1.0.25-28.1 as a component of SUSE Linux Enterprise Server 12 SP2 libsndfile1-1.0.25-28.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libsndfile1-1.0.25-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libsndfile1-32bit-1.0.25-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libsndfile1-1.0.25-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsndfile1-32bit-1.0.25-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsndfile-devel-1.0.25-28.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libsndfile-devel-1.0.25-28.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. CVE-2017-7585 SUSE Linux Enterprise Desktop 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libsndfile-devel-1.0.25-28.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-28.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171040-1/ https://www.suse.com/security/cve/CVE-2017-7585.html CVE-2017-7585 https://bugzilla.suse.com/1033054 SUSE Bug 1033054 https://bugzilla.suse.com/1033914 SUSE Bug 1033914 https://bugzilla.suse.com/1033915 SUSE Bug 1033915 In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. CVE-2017-7586 SUSE Linux Enterprise Desktop 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libsndfile-devel-1.0.25-28.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-28.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171040-1/ https://www.suse.com/security/cve/CVE-2017-7586.html CVE-2017-7586 https://bugzilla.suse.com/1033053 SUSE Bug 1033053 In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585. CVE-2017-7741 SUSE Linux Enterprise Desktop 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libsndfile-devel-1.0.25-28.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-28.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171040-1/ https://www.suse.com/security/cve/CVE-2017-7741.html CVE-2017-7741 https://bugzilla.suse.com/1033054 SUSE Bug 1033054 https://bugzilla.suse.com/1033915 SUSE Bug 1033915 In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585. CVE-2017-7742 SUSE Linux Enterprise Desktop 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-28.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libsndfile-devel-1.0.25-28.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-28.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171040-1/ https://www.suse.com/security/cve/CVE-2017-7742.html CVE-2017-7742 https://bugzilla.suse.com/1033054 SUSE Bug 1033054 https://bugzilla.suse.com/1033914 SUSE Bug 1033914