[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 26 May 2009 14:16:02 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...us.mitre.org
Subject: Re: CVE Request for libsndfile
Two CVEs, one for the original disclosure and one for a later disclosure,
i.e. the extra issue that was found and fixed by the developer.
- Steve
======================================================
Name: CVE-2009-1788
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1788
Reference: MISC:http://trapkit.de/advisories/TKADV2009-006.txt
Reference: CONFIRM:http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/
Reference: CONFIRM:http://www.mega-nerd.com/libsndfile/
Reference: BID:34978
Reference: URL:http://www.securityfocus.com/bid/34978
Reference: SECUNIA:35076
Reference: URL:http://secunia.com/advisories/35076
Reference: VUPEN:ADV-2009-1324
Reference: URL:http://www.vupen.com/english/advisories/2009/1324
Reference: VUPEN:ADV-2009-1348
Reference: URL:http://www.vupen.com/english/advisories/2009/1348
Reference: XF:libsndfile-aiff-voc-bo(50541)
Reference: URL:http://xforce.iss.net/xforce/xfdb/50541
Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15
through 1.0.19, as used in Winamp 5.552 and possibly other media
programs, allows remote attackers to cause a denial of service
(application crash) and possibly execute arbitrary code via a VOC file
with an invalid header value.
======================================================
Name: CVE-2009-1791
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1791
Reference: CONFIRM:http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/
Reference: CONFIRM:http://www.mega-nerd.com/libsndfile/
Reference: BID:34978
Reference: URL:http://www.securityfocus.com/bid/34978
Reference: SECUNIA:35076
Reference: URL:http://secunia.com/advisories/35076
Reference: VUPEN:ADV-2009-1324
Reference: URL:http://www.vupen.com/english/advisories/2009/1324
Reference: XF:libsndfile-aiff-voc-bo(50541)
Reference: URL:http://xforce.iss.net/xforce/xfdb/50541
Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15
through 1.0.19, as used in Winamp 5.552 and possibly other media
programs, allows remote attackers to cause a denial of service
(application crash) and possibly execute arbitrary code via an AIFF
file with an invalid header value.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
