libsndfile: CVE-2017-14245, CVE-2017-14246

Debian Bug report logs - #876682
libsndfile: CVE-2017-14245, CVE-2017-14246

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libsndfile: CVE-2017-14245, CVE-2017-14246

Date: Sun, 24 Sep 2017 22:09:27 +0200

[Message part 1 (text/plain, inline)]

Package: libsndfile
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

the following vulnerabilities were published for libsndfile.

CVE-2017-14245[0]:
| An out of bounds read in the function d2alaw_array() in alaw.c of
| libsndfile 1.0.28 may lead to a remote DoS attack or information
| disclosure, related to mishandling of the NAN and INFINITY
| floating-point values.

CVE-2017-14246[1]:
| An out of bounds read in the function d2ulaw_array() in ulaw.c of
| libsndfile 1.0.28 may lead to a remote DoS attack or information
| disclosure, related to mishandling of the NAN and INFINITY
| floating-point values.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-14245
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14245
[1] https://security-tracker.debian.org/tracker/CVE-2017-14246
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14246

Please adjust the affected versions in the BTS as needed.

Regards,

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #20 received at 876682-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 876682-submitter@bugs.debian.org

Subject: closing 876682

Date: Tue, 12 Feb 2019 22:11:09 +0100

close 876682 1.0.28-5
thanks

Send a report that this bug log contains spam.