Security Update for libsndfile
Summary
DLA-956-1: libsndfile - security update. Affects libsndfile versions < 1.0.25-9.1+deb7u2. Fixed in 1.0.25-9.1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libsndfile is a library for reading and writing audio files. It provides a simple and straightforward interface for handling various audio formats. However, several vulnerabilities have been discovered in version 1.0.28 of libsndfile, which could allow remote attackers to cause a denial of service or potentially have other unspecified impacts. These vulnerabilities are identified as CVE-2017-8361, CVE-2017-8362, CVE-2017-8363, and CVE-2017-8365.
Vulnerability Detail
The vulnerabilities in libsndfile version 1.0.28 are related to the flac_buffer_copy function in flac.c and the i2les_array function in pcm.c. These vulnerabilities can be exploited by remote attackers through crafted audio files. The specific impacts include buffer overflow, application crash, invalid read, heap-based buffer over-read, and buffer over-read. These vulnerabilities can potentially lead to a complete denial of service or other unknown consequences.
How To Fix
Minimum fixed version
1.0.25-9.1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libsndfileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update as soon as possible to mitigate the risks.
Conclusion
In conclusion, libsndfile version 1.0.28 is vulnerable to multiple security issues that can be exploited remotely through specially crafted audio files. To mitigate these risks, it is crucial to upgrade to version 1.0.25-9.1+deb7u2 or later. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libsndfile →
FAQ
libsndfile is a library for reading and writing audio files. It supports various audio formats and provides a simple interface for audio file manipulation.
The vulnerabilities in libsndfile can lead to a denial of service, application crashes, and potentially other unspecified impacts. These vulnerabilities can be exploited remotely through specially crafted audio files.
To fix these vulnerabilities, you need to upgrade your libsndfile packages to version 1.0.25-9.1+deb7u2 or later. This can be done by obtaining the updated packages from the official Debian repositories or using the package manager of your operating system.
There are no known workarounds for these vulnerabilities. It is crucial to apply the security update to mitigate the risks.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for libsndfile.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
