ALSA-2022:7979 - speex security update
Summary
ALSA-2022:7979: Low: speex security update. Affects speex versions < 1.2.0-11.el9. Fixed in 1.2.0-11.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates.
Vulnerability Detail
The vulnerability identified as CVE-2020-23903 affects the speex package. It is caused by a divide by zero error in the read_samples() function when processing a crafted WAV file. This vulnerability can be exploited by an attacker to cause a denial of service (DoS) condition. Further details, including the impact and a CVSS score, can be found on the CVE page linked in the References section.
How To Fix
Minimum fixed version
1.2.0-11.el9
This is the first release that contains the fix.
sudo dnf update speexTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the speex package is affected by a divide by zero vulnerability (CVE-2020-23903) that can lead to a denial of service condition. It is recommended to update to version 1.2.0-11.el9 or later to fix this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for speex →
FAQ
Speex is a patent-free compression format designed for voice communications at low bit-rates.
The vulnerability can be exploited to cause a denial of service (DoS) condition.
Yes, the CVSS score for this vulnerability can be found on the CVE page linked in the References section.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will alert you in real-time.
For detailed information on the changes in the updated speex package, refer to the AlmaLinux Release Notes linked in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for speex.
