Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 25 May 2009 22:57:59 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Cc: coley@...us.mitre.org
Subject: Re: CVE Request for libsndfile

On Friday 15 May 2009, Jamie Strandboge wrote:
> From http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/:
>
>   There's a new release of libsndfile available in the usual place.
> This is a security bug fix release which fixes a potential heap
> overflow in VOC files found and reported by Tobias Klein (
> http://www.trapkit.de/ ) and another in the AIFF file parser found by
> me.
>
> 1.0.20 supposedly fixes it, with the author supplying patches back to
> 1.0.15. Can we get a CVE for this?

The trapkit.de advisory is up here:
http://www.trapkit.de/advisories/TKADV2009-006.txt

Secunia also has an advisory:
http://secunia.com/advisories/35076/

If one or two CVE identifiers could be reserved, that'd be great.


Robert

Download attachment "signature.asc " of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.