[USN-525-1] libsndfile vulnerability
Date: Thu, 4 Oct 2007 17:17:31 -0700
From: Kees Cook <kees@ubuntu.com.>
To: [email protected]
Subject: [USN-525-1] libsndfile vulnerability
Message-ID: <20071005001731.GP10703@outflux.net.>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="zKD0QXBepZ0ysD7Q"
Content-Disposition: inline
Organization: Ubuntu
X-MIMEDefang-Filter: outflux$Revision: 1.301 $
X-HELO: gorgon.outflux.net
X-Scanned-By: MIMEDefang 2.57 on 10.2.0.1
X-Virus-Scanned: antivirus-gw at tyumen.ru
--zKD0QXBepZ0ysD7Q
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=20
Ubuntu Security Notice USN-525-1 October 04, 2007
libsndfile vulnerability
CVE-2007-4974
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
libsndfile1 1.0.12-3ubuntu1
Ubuntu 6.10:
libsndfile1 1.0.16-1ubuntu0.6.10.1
Ubuntu 7.04:
libsndfile1 1.0.16-1ubuntu0.7.04.1
After a standard system upgrade you need to restart your session to affect
the necessary changes.
Details follow:
Robert Buchholz discovered that libsndfile did not correctly validate the
size of its memory buffers. If a user were tricked into playing a specially
crafted FLAC file, a remote attacker could execute arbitrary code with user
privileges.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.12-3ubuntu1.diff.gz
Size/MD5: 5335 a232e010747ae75f87432f426aaac11f
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.12-3ubuntu1.dsc
Size/MD5: 639 921596b90ab0e2afb1836c7e3c292f73
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.12.orig.tar.gz
Size/MD5: 798471 03718b7b225b298f41c19620b8906108
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.12-3ubuntu1_amd64.deb
Size/MD5: 308020 d1274d3dbeae2e96f3a64b4395051bb6
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.12-3ubuntu1_amd64.deb
Size/MD5: 179202 42f4102ac6cef2c1d4905383f646c2bf
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.12-3ubuntu1_amd64.deb
Size/MD5: 63764 9b35c766d93f8e00590faa6b7d5351e8
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.12-3ubuntu1_i386.deb
Size/MD5: 300158 e801ce100a759b4481bd9b81501d4321
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.12-3ubuntu1_i386.deb
Size/MD5: 182324 3ff53ef6c00e306f05e367d316fc303a
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.12-3ubuntu1_i386.deb
Size/MD5: 63674 ea1f9f762ffbd80df2337fb9dc08e5d1
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.12-3ubuntu1_powerpc.deb
Size/MD5: 331752 99e5090a989a123445f2d6f194c36a25
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.12-3ubuntu1_powerpc.deb
Size/MD5: 195800 316b04008ac17a3e13be591cf102a659
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.12-3ubuntu1_powerpc.deb
Size/MD5: 69338 72f0b032595ce60b82b9f8924cfd9cc5
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.12-3ubuntu1_sparc.deb
Size/MD5: 323540 9d082dcc95f2c43378314df01d301f1f
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.12-3ubuntu1_sparc.deb
Size/MD5: 197678 028e918bd6fb91e953090709974dee3a
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.12-3ubuntu1_sparc.deb
Size/MD5: 64136 e1b0c464a3176e39a03c9645d6c4a6b9
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.16-1ubuntu0.6.10.1.diff.gz
Size/MD5: 5525 4a42e83ea97c510607085d6d393addf8
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.16-1ubuntu0.6.10.1.dsc
Size/MD5: 667 9f622edbc2aad7470161a288dcaf8ffa
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.16.orig.tar.gz
Size/MD5: 857117 773b6639672d39b6342030c7fd1e9719
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.16-1ubuntu0.6.10.1_amd64.deb
Size/MD5: 321862 bcf08d7a023e522640f547f8b4519951
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.16-1ubuntu0.6.10.1_amd64.deb
Size/MD5: 188260 eacc338dbf6c34d9cd4fac61b946c4bd
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.16-1ubuntu0.6.10.1_amd64.deb
Size/MD5: 70778 2d616afb614861f00a6fafcc2eab2fb3
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.16-1ubuntu0.6.10.1_i386.deb
Size/MD5: 314374 91362ac43fb0937b564d1b5fa3242050
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.16-1ubuntu0.6.10.1_i386.deb
Size/MD5: 196146 33714e82c14ce17e628a0f2a50b7c0bc
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.16-1ubuntu0.6.10.1_i386.deb
Size/MD5: 70834 fa2eb1049320c90728ada95e5277803b
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.16-1ubuntu0.6.10.1_powerpc.deb
Size/MD5: 347156 3301ea8ab145c62df52723d5da21d4aa
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.16-1ubuntu0.6.10.1_powerpc.deb
Size/MD5: 208348 d274b82183319d13474a12a367bd3bfd
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.16-1ubuntu0.6.10.1_powerpc.deb
Size/MD5: 76186 a4ef0848989d954b40c06f0acd17c59c
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.16-1ubuntu0.6.10.1_sparc.deb
Size/MD5: 335470 1ba9545348975046ebd333d8f33dcbe2
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.16-1ubuntu0.6.10.1_sparc.deb
Size/MD5: 208484 867aaf6cf98f6be0cfdf4b4d17ab5f01
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.16-1ubuntu0.6.10.1_sparc.deb
Size/MD5: 70904 55425663359b4aa24fcd913b2573f2e2
Updated packages for Ubuntu 7.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.16-1ubuntu0.7.04.1.diff.gz
Size/MD5: 5658 06937165d9e19c82085e1ade9847b243
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.16-1ubuntu0.7.04.1.dsc
Size/MD5: 751 5f87e71d5f7101fb7e399dc43c3d60cf
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile_=
1.0.16.orig.tar.gz
Size/MD5: 857117 773b6639672d39b6342030c7fd1e9719
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.16-1ubuntu0.7.04.1_amd64.deb
Size/MD5: 322110 c271f688da6781c0fd298262f9f7f915
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.16-1ubuntu0.7.04.1_amd64.deb
Size/MD5: 188558 e92db334b4d9c1fd72b2fe00e54612e6
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.16-1ubuntu0.7.04.1_amd64.deb
Size/MD5: 71060 2b363b833ea55410ee2732a413137b5f
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.16-1ubuntu0.7.04.1_i386.deb
Size/MD5: 314416 41c5020153269c90802136f7129e7bdd
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.16-1ubuntu0.7.04.1_i386.deb
Size/MD5: 196452 724a2058aaa745a01ecd11b970d84a45
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.16-1ubuntu0.7.04.1_i386.deb
Size/MD5: 71008 49f10761a1cccaf4ce08508ff22601f4
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.16-1ubuntu0.7.04.1_powerpc.deb
Size/MD5: 347362 3be7ff70688b3da0b99fa779f1321a19
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.16-1ubuntu0.7.04.1_powerpc.deb
Size/MD5: 210224 3bcc466c8cb926a5595846581b0d6f49
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.16-1ubuntu0.7.04.1_powerpc.deb
Size/MD5: 79066 51fbd324f3e3fa3281677408414c6251
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
-dev_1.0.16-1ubuntu0.7.04.1_sparc.deb
Size/MD5: 335432 00f8abc6db36fcf84b74d85f5163fbd5
http://security.ubuntu.com/ubuntu/pool/main/libs/libsndfile/libsndfile1=
_1.0.16-1ubuntu0.7.04.1_sparc.deb
Size/MD5: 208866 b24b1a613ae28805071e6ab3d1912732
http://security.ubuntu.com/ubuntu/pool/universe/libs/libsndfile/sndfile=
-programs_1.0.16-1ubuntu0.7.04.1_sparc.deb
Size/MD5: 71638 85be6e0c7d7e141982053f5d680a76c8
--zKD0QXBepZ0ysD7Q
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFHBYKbH/9LqRcGPm0RAvktAJ4o+TIKF5saCEZpmXSozn5G1UNDLgCglEzi
4iWDHypVS+wo4PViSrz9gX4=
=oZ9i
-----END PGP SIGNATURE-----
--zKD0QXBepZ0ysD7Q--
