CVE-2007-4974 heap overflow via crafted PCM data

Debian Bug report logs - #443386
CVE-2007-4974 heap overflow via crafted PCM data

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: submit@bugs.debian.org

Subject: CVE-2007-4974 heap overflow via crafted PCM data

Date: Fri, 21 Sep 2007 01:06:43 +0200

[Message part 1 (text/plain, inline)]

Package: libsndfile
Version: 1.0.16-1
Severity: grave
Tags: security

Hi,
a CVE was published for libsndfile.
CVE-2007-4974[0]:
Heap-based buffer overflow in libsndfile 1.0.17 and earlier 
might allow remote attackers to execute arbitrary code via a 
FLAC file with crafted PCM data containing a block with a 
size that exceeds the previous block size.

If you fix this bug please include the CVE id in the 
changelog data.

See https://bugs.gentoo.org/show_bug.cgi?id=192834 for 
further information and patch.

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4974

Kind regards
Nico
-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 443386@bugs.debian.org (full text, mbox, reply):

From: Erik de Castro Lopo <erikd@mega-nerd.com>

To: Nico Golde <nion@debian.org>, 443386@bugs.debian.org

Subject: Re: Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

Date: Fri, 21 Sep 2007 10:04:55 +1000

Nico Golde wrote:

> If you fix this bug please include the CVE id in the 
> changelog data.

I has already beedn fixed, so there is no mention of the CVE id
in the changelog.

> [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4974

Err, that URL doesn't give me anything useful.

Erik
-- 
-----------------------------------------------------------------
Erik de Castro Lopo
-----------------------------------------------------------------
Unsolicited Broadcast Email is Forced Pay-per-view
Advertising.

Message #15 received at 443386-close@bugs.debian.org (full text, mbox, reply):

From: Samuel Mimram <smimram@debian.org>

To: 443386-close@bugs.debian.org

Subject: Bug#443386: fixed in libsndfile 1.0.17-4

Date: Fri, 21 Sep 2007 00:02:11 +0000

Source: libsndfile
Source-Version: 1.0.17-4

We believe that the bug you reported is fixed in the latest version of
libsndfile, which is due to be installed in the Debian FTP archive:

libsndfile1-dev_1.0.17-4_i386.deb
  to pool/main/libs/libsndfile/libsndfile1-dev_1.0.17-4_i386.deb
libsndfile1_1.0.17-4_i386.deb
  to pool/main/libs/libsndfile/libsndfile1_1.0.17-4_i386.deb
libsndfile_1.0.17-4.diff.gz
  to pool/main/libs/libsndfile/libsndfile_1.0.17-4.diff.gz
libsndfile_1.0.17-4.dsc
  to pool/main/libs/libsndfile/libsndfile_1.0.17-4.dsc
sndfile-programs_1.0.17-4_i386.deb
  to pool/main/libs/libsndfile/sndfile-programs_1.0.17-4_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 443386@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Samuel Mimram <smimram@debian.org> (supplier of updated libsndfile package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Thu, 20 Sep 2007 23:40:17 +0000
Source: libsndfile
Binary: libsndfile1 libsndfile1-dev sndfile-programs
Architecture: source i386
Version: 1.0.17-4
Distribution: unstable
Urgency: low
Maintainer: Samuel Mimram <smimram@debian.org>
Changed-By: Samuel Mimram <smimram@debian.org>
Description: 
 libsndfile1 - Library for reading/writing audio files
 libsndfile1-dev - Library for reading/writing audio files
 sndfile-programs - Sample programs that use libsndfile
Closes: 443386
Changes: 
 libsndfile (1.0.17-4) unstable; urgency=low
 .
   * Added overflow.dpatch to fix a possible heap-based buffer overflow
     (CVE-2007-4974), closes: #443386.
Files: 
 0699bba5f79d92ac39aecdd8036e9b71 703 devel optional libsndfile_1.0.17-4.dsc
 c264e3c8f9d3a157f143ed03eee3991c 9666 devel optional libsndfile_1.0.17-4.diff.gz
 3552eb74be37724ddbd68719c1051796 323414 libdevel optional libsndfile1-dev_1.0.17-4_i386.deb
 ddaac07082d16397cb81dd2466b61c46 196254 libs optional libsndfile1_1.0.17-4_i386.deb
 60c22fa21d0ab9096effc6e441ff3ea1 75908 utils optional sndfile-programs_1.0.17-4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG8wa2Iae1O4AJae8RAu70AJ0f5gsCuhKCMKPdYYtPZjI8yRkebQCfYjzU
L9wQAISAEFOofInt8LSNAm8=
=YeoL
-----END PGP SIGNATURE-----

Message #20 received at 443386@bugs.debian.org (full text, mbox, reply):

From: Samuel Mimram <samuel.mimram@ens-lyon.org>

To: Erik de Castro Lopo <erikd@mega-nerd.com>, 443386@bugs.debian.org

Cc: Nico Golde <nion@debian.org>

Subject: Re: Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

Date: Fri, 21 Sep 2007 01:19:37 +0100

Erik de Castro Lopo wrote:
> Nico Golde wrote:
> 
>> If you fix this bug please include the CVE id in the 
>> changelog data.
> 
> I has already beedn fixed, so there is no mention of the CVE id
> in the changelog.

Do you mean that it is already fixed in the version that Debian is
shipping (1.0.17)??? Just to make sure, the changelog mentionned here is
the one of the Debian package.

Cheers,

Samuel.

Message #25 received at 443386@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Erik de Castro Lopo <erikd@mega-nerd.com>, 443386@bugs.debian.org

Subject: Re: Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

Date: Fri, 21 Sep 2007 02:27:16 +0200

[Message part 1 (text/plain, inline)]

Hi,
* Erik de Castro Lopo <erikd@mega-nerd.com> [2007-09-21 02:16]:
> Nico Golde wrote:
> 
> > If you fix this bug please include the CVE id in the 
> > changelog data.
> 
> I has already beedn fixed, so there is no mention of the CVE id
> in the changelog.

At least 1.0.17-3, testing and stable were vulnerable when 
reporting this issue.

> > [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4974
> 
> Err, that URL doesn't give me anything useful.

It does give you a link to the gentoo bts where you find a 
patch.
Cheers
Nico
> 
> Erik
> -- 
> -----------------------------------------------------------------
> Erik de Castro Lopo
> -----------------------------------------------------------------
> Unsolicited Broadcast Email is Forced Pay-per-view
> Advertising.
> 
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-bugs-dist-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> 

-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #32 received at 443386@bugs.debian.org (full text, mbox, reply):

From: Erik de Castro Lopo <erikd@mega-nerd.com>

To: Nico Golde <nion@debian.org>

Cc: 443386@bugs.debian.org

Subject: Re: Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

Date: Fri, 21 Sep 2007 11:44:32 +1000

Nico Golde wrote:

> Hi,
> * Erik de Castro Lopo <erikd@mega-nerd.com> [2007-09-21 02:16]:
> > Nico Golde wrote:
> > 
> > > If you fix this bug please include the CVE id in the 
> > > changelog data.
> > 
> > I has already beedn fixed, so there is no mention of the CVE id
> > in the changelog.
> 
> At least 1.0.17-3, testing and stable were vulnerable when 
> reporting this issue.

Ah, I'm the upstream author and I was talking about my changelog
for the code currently in Bzr.

> > > [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4974
> > 
> > Err, that URL doesn't give me anything useful.
> 
> It does give you a link to the gentoo bts where you find a 
> patch.

Ok, got it. That was my patch.

Cheers,
Erik
-- 
-----------------------------------------------------------------
Erik de Castro Lopo
-----------------------------------------------------------------
Microsoft VISTA : Virus Infection Spyware Trojans and Adware!

Send a report that this bug log contains spam.