[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 14 Jul 2011 08:35:02 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com, Erik de Castro Lopo <erikd@...a-nerd.com>,
Secunia Research <vuln@...unia.com>
Subject: CVE Request -- libsndfile -- Integer overflow by processing certain
PAF files
Hello Josh, Steve, vendors,
an integer overflow, leading to heap-based buffer overflow flaw was
found in the way libsndfile, library for reading and writing of sound
files, processed certain PARIS Audio Format (PAF) audio files with
crafted count of channels in the PAF file header. A remote attacker
could provided a specially-crafted PAF audio file, which once opened by
a local, unsuspecting user in an application, linked against libsndfile,
could lead to that particular application crash (denial of service),
or, potentially arbitrary code execution with the privileges of the
user running the application.
References:
[1] https://bugs.gentoo.org/show_bug.cgi?id=375125
[2] http://www.securelist.com/en/advisories/45125
[3] http://secunia.com/advisories/45125/
[4] http://www.mega-nerd.com/libsndfile/
[5] https://bugzilla.redhat.com/show_bug.cgi?id=721234
Relevant upstream patch (from Bzr log):
---------------------------------------
revno: 1610
committer: Erik de Castro Lopo <erikd@...a-nerd.com>
branch nick: libsndfile-dev
timestamp: Wed 2011-07-06 19:40:05 +1000
message:
Fix for Secunia Advisory SA45125, heap overflow in PAF file handler.
Could you allocate a CVE identifier for this?
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
