Security update for libsndfile SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0352-1 Final 1 1 2018-02-02T11:33:59Z current 2018-02-02T11:33:59Z 2018-02-02T11:33:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libsndfile This update for libsndfile fixes the following issues: - CVE-2017-16942: Divide-by-zero in the function wav_w64_read_fmt_chunk(), which may lead to Denial of service (bsc#1069874). - CVE-2017-6892: Fixed an out-of-bounds read memory access in the aiff_read_chanmap() (bsc#1043978). - CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file. (bsc#1059911) - CVE-2017-14245: An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values. (bsc#1059912) - CVE-2017-14246: An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.(bsc#1059913) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP2-2018-247,SUSE-SLE-DESKTOP-12-SP3-2018-247,SUSE-SLE-RPI-12-SP2-2018-247,SUSE-SLE-SDK-12-SP2-2018-247,SUSE-SLE-SDK-12-SP3-2018-247,SUSE-SLE-SERVER-12-SP2-2018-247,SUSE-SLE-SERVER-12-SP3-2018-247 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180352-1/ Link for SUSE-SU-2018:0352-1 https://lists.suse.com/pipermail/sle-security-updates/2018-February/003705.html E-Mail link for SUSE-SU-2018:0352-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1043978 SUSE Bug 1043978 https://bugzilla.suse.com/1059911 SUSE Bug 1059911 https://bugzilla.suse.com/1059912 SUSE Bug 1059912 https://bugzilla.suse.com/1059913 SUSE Bug 1059913 https://bugzilla.suse.com/1069874 SUSE Bug 1069874 https://www.suse.com/security/cve/CVE-2017-14245/ SUSE CVE CVE-2017-14245 page https://www.suse.com/security/cve/CVE-2017-14246/ SUSE CVE CVE-2017-14246 page https://www.suse.com/security/cve/CVE-2017-14634/ SUSE CVE CVE-2017-14634 page https://www.suse.com/security/cve/CVE-2017-16942/ SUSE CVE CVE-2017-16942 page https://www.suse.com/security/cve/CVE-2017-6892/ SUSE CVE CVE-2017-6892 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 libsndfile1-1.0.25-36.7.2 libsndfile1-32bit-1.0.25-36.7.2 libsndfile-devel-1.0.25-36.7.2 libsndfile1-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Desktop 12 SP2 libsndfile1-32bit-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Desktop 12 SP2 libsndfile1-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 libsndfile1-32bit-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 libsndfile1-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server 12 SP2 libsndfile1-32bit-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server 12 SP2 libsndfile1-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server 12 SP3 libsndfile1-32bit-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server 12 SP3 libsndfile1-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libsndfile1-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsndfile1-32bit-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsndfile1-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libsndfile1-32bit-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libsndfile-devel-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libsndfile-devel-1.0.25-36.7.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values. CVE-2017-14245 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP3:libsndfile-devel-1.0.25-36.7.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180352-1/ https://www.suse.com/security/cve/CVE-2017-14245.html CVE-2017-14245 https://bugzilla.suse.com/1059912 SUSE Bug 1059912 https://bugzilla.suse.com/1071777 SUSE Bug 1071777 An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values. CVE-2017-14246 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP3:libsndfile-devel-1.0.25-36.7.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180352-1/ https://www.suse.com/security/cve/CVE-2017-14246.html CVE-2017-14246 https://bugzilla.suse.com/1059913 SUSE Bug 1059913 https://bugzilla.suse.com/1071767 SUSE Bug 1071767 In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file. CVE-2017-14634 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP3:libsndfile-devel-1.0.25-36.7.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180352-1/ https://www.suse.com/security/cve/CVE-2017-14634.html CVE-2017-14634 https://bugzilla.suse.com/1059911 SUSE Bug 1059911 In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead to DoS when playing a crafted audio file. CVE-2017-16942 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP3:libsndfile-devel-1.0.25-36.7.2 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180352-1/ https://www.suse.com/security/cve/CVE-2017-16942.html CVE-2017-16942 https://bugzilla.suse.com/1069874 SUSE Bug 1069874 In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file. CVE-2017-6892 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Desktop 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-1.0.25-36.7.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libsndfile1-32bit-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP2:libsndfile-devel-1.0.25-36.7.2 SUSE Linux Enterprise Software Development Kit 12 SP3:libsndfile-devel-1.0.25-36.7.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180352-1/ https://www.suse.com/security/cve/CVE-2017-6892.html CVE-2017-6892 https://bugzilla.suse.com/1043978 SUSE Bug 1043978