oss-sec mailing list archives
Re: CVE request: opus codec before 1.0.2
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 13 Dec 2012 16:35:09 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/13/2012 02:29 PM, Hanno Böck wrote:
On Tue, 11 Dec 2012 11:02:15 -0700 Kurt Seifried <kseifried () redhat com> wrote:-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1On 12/11/2012 05:32 AM, Hanno Böck wrote:http://lists.xiph.org/pipermail/opus/2012-December/001846.html sounds like a low-severity security issue: "Opus 1.0.2 fixes an out-of-bounds read that could be triggered by a malicious Opus packet by causing an integer wrap-around in the padding code. Considering that the packet would have to be at least 16 MB in size and that no out-of-bounds write is possible, the severity is very low." Fixed in opus 1.0.2.What's the security impact? does the service crash?I don't know any details, just read the release announcement and it sounded security relevant. This is the commit: http://git.xiph.org/?p=opus.git;a=commit;h=466c879a063e77941b95a6a0298905ba707667ac Sorry, I don't know more.
No problem, not assigning for now unless someone comes up with a security impact/additional info/etc. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQymYtAAoJEBYNRVNeJnmTTQUP/jjV257wSvsTrrQ4bzZlRd/i yMotxGpZcCca+mKnGX8JT5fMOOvirVwB4VIXgOdFBS5JLYtSFTQR8yxRMBQxztrU qeQ+acv3BZEvc/jq/lvw9BE2uICwTzMLVgUZLP8MslmwdOLKrSFOxEftmoFFpxBF XQa4Yck1NdQms3tWCu/kblj7dAt0neYdKsdUthlvD0BGCyO5fpWVNNxdNlgBsINf 0KUDAahC3dy14g7IIeWfaFHUq5Z5JHfYkbIXUdEl/GcdZHQkcKgC13sNCmeROYAZ 8/8cFe9GEwHGwrtbYB9IFxu4Uqo6G2pIWQNsTmM9hgtj2kdZ8qiZjM+hAKvU+ojQ zH6ZhWP4ruqkaOFJj5/3MJaVvzitHcKVA0D5J/F7BMwwhFYtnL9YMn67dAHcY1ZW TraEWWyIXxmeTWi0kn8Yb+qOKLCmVdsO4viiP0bZdXcovCs3WmCtbgfXP0pPi2Po Dk77wt/MUkwRbpfhzOBDrj7+z3rfMa2Qp+YLaBux2O1gGgUdNa4h1DrfwsieajvS KwuRe47Mb/82wSI7L9l+ikdeV1k/N1pfmyxcLw6iExJgAhDDG2IE8kIFHqbFCDzU 76RUYEb6UCxGjdSDgeaJzZsByE1Y3Haup6Ai7uJYMP7ENfXzx+lsh+uRXPQWZnRz KMR9Q2yU9X2TyWGQf7qd =heyf -----END PGP SIGNATURE-----
Current thread:
- CVE request: opus codec before 1.0.2 Hanno Böck (Dec 11)
- Re: CVE request: opus codec before 1.0.2 Kurt Seifried (Dec 11)
- Re: CVE request: opus codec before 1.0.2 Hanno Böck (Dec 13)
- Re: CVE request: opus codec before 1.0.2 Kurt Seifried (Dec 13)
- Re: CVE request: opus codec before 1.0.2 Hanno Böck (Dec 13)
- Re: CVE request: opus codec before 1.0.2 Kurt Seifried (Dec 11)