libsndfile-1.0.28-10.el8

エラータID: AXSA:2020-305:02

Release date: 
Tuesday, September 8, 2020 - 08:05
Subject: 
libsndfile-1.0.28-10.el8
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
Moderate
Description: 

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV.

Security Fix(es):

* libsndfile: stack-based buffer overflow in sndfile-deinterleave utility (CVE-2018-13139)

* libsndfile: buffer over-read in the function i2alaw_array in alaw.c (CVE-2018-19662)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2018-13139
A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. The vulnerability can be triggered by the executable sndfile-deinterleave.
CVE-2018-19662
An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. libsndfile-1.0.28-10.el8.src.rpm
    MD5: 96ddfaf52ba5041f127004e0ee840868
    SHA-256: 374ddd768e12875000cc5f65eb858c4450fe4238a58df36ccf1be4ce7a62dd02
    Size: 1.17 MB

Asianux Server 8 for x86_64
  1. libsndfile-1.0.28-10.el8.x86_64.rpm
    MD5: 047be69f969605fb9848cae17620ed17
    SHA-256: 85782d44d56395f0bec8f041f884db990882f1e026327c0185aa1c50c56ade12
    Size: 192.95 kB
  2. libsndfile-1.0.28-10.el8.i686.rpm
    MD5: 9ddbd88c74c1439a7c018009f16046e5
    SHA-256: 2bd3ab80a81c0bfe64ad9ae06d9bf6b45d503fe2814ccfabdbf6b5bef888230a
    Size: 217.36 kB