oss-sec mailing list archives
CVE Request -- libsndfile -- Integer overflow by processing certain PAF files
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Thu, 14 Jul 2011 08:35:02 +0200
Hello Josh, Steve, vendors, an integer overflow, leading to heap-based buffer overflow flaw was found in the way libsndfile, library for reading and writing of sound files, processed certain PARIS Audio Format (PAF) audio files with crafted count of channels in the PAF file header. A remote attacker could provided a specially-crafted PAF audio file, which once opened by a local, unsuspecting user in an application, linked against libsndfile, could lead to that particular application crash (denial of service), or, potentially arbitrary code execution with the privileges of the user running the application. References: [1] https://bugs.gentoo.org/show_bug.cgi?id=375125 [2] http://www.securelist.com/en/advisories/45125 [3] http://secunia.com/advisories/45125/ [4] http://www.mega-nerd.com/libsndfile/ [5] https://bugzilla.redhat.com/show_bug.cgi?id=721234 Relevant upstream patch (from Bzr log): --------------------------------------- revno: 1610 committer: Erik de Castro Lopo <erikd () mega-nerd com> branch nick: libsndfile-dev timestamp: Wed 2011-07-06 19:40:05 +1000 message: Fix for Secunia Advisory SA45125, heap overflow in PAF file handler. Could you allocate a CVE identifier for this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Jan Lieskovsky (Jul 13)
- Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Erik de Castro Lopo (Jul 14)
- Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Jan Lieskovsky (Jul 14)
- Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Erik de Castro Lopo (Jul 14)
- Re: Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Jan Lieskovsky (Jul 15)
- Re: Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Dan Rosenberg (Jul 15)
- Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Jan Lieskovsky (Jul 14)
- Re: Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Dan Rosenberg (Jul 14)
- Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Erik de Castro Lopo (Jul 14)
- Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files Huzaifa Sidhpurwala (Jul 17)