[Buildroot] [PATCH] libsndfile: security bump to version 1.0.28
Peter Korsgaard
peter at korsgaard.com
Thu Apr 27 08:15:52 UTC 2017
>>>>> "Peter" == Peter Korsgaard <peter at korsgaard.com> writes:
> Fixes:
> CVE-2017-7585 - In libsndfile before 1.0.28, an error in the
> "flac_buffer_copy()" function (flac.c) can be exploited to cause a
> stack-based buffer overflow via a specially crafted FLAC file.
> CVE-2017-7586 - In libsndfile before 1.0.28, an error in the "header_read()"
> function (common.c) when handling ID3 tags can be exploited to cause a
> stack-based buffer overflow via a specially crafted FLAC file.
> CVE-2017-7741 - In libsndfile before 1.0.28, an error in the
> "flac_buffer_copy()" function (flac.c) can be exploited to cause a
> segmentation violation (with write memory access) via a specially crafted
> FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
> CVE-2017-7742 - In libsndfile before 1.0.28, an error in the
> "flac_buffer_copy()" function (flac.c) can be exploited to cause a
> segmentation violation (with read memory access) via a specially crafted
> FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
> Dop undocumented patch adjusting SUBDIRS in Makefile.in as it no longer
> applies. Instead pass --disable-full-suite to disable man pages,
> documentation and programs, as that was presumably the reason for the patch.
> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
> ---
Committed, thanks.
--
Bye, Peter Korsgaard
More information about the buildroot
mailing list