Debian Package Tracker

general

source: lame (main)
version: 3.100-2
maintainer: Debian Multimedia Maintainers (archive) [DMD]
uploaders: Fabian Greffrath [DMD] – Reinhard Tartler [DMD]
arch: all any
std-ver: 4.1.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.99.5+repack1-3+deb7u1
oldstable: 3.99.5+repack1-7+deb8u1
old-p-u: 3.99.5+repack1-7+deb8u2
stable: 3.99.5+repack1-9
testing: 3.100-2
unstable: 3.100-2

versioned links

3.99.5+repack1-3+deb7u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.99.5+repack1-7+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.99.5+repack1-7+deb8u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.99.5+repack1-9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.100-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

lame
lame-doc
libmp3lame-dev
libmp3lame0

action needed

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug (2 if counting merged bugs), consider including or untagging them.

Created: 2017-11-21 Last update: 2018-06-21 19:38

4 new commits since last upload, time to release an update? normal

vcswatch reports that this package seems to have new commits in its VCS. You should consider updating the debian/changelog and uploading this new version into the archive.

The Vcs URL is using anonscm.debian.org. Please update it for the move to salsa.debian.org.

Created: 2018-02-20 Last update: 2018-06-09 20:02

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-02-13 Last update: 2018-04-15 07:52

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

lame-doc could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2018-06-21 20:14

2 ignored security issues in stretch low

There are 2 open security issues in stretch.

2 issues skipped by the security teams:

CVE-2017-15019: LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call.
CVE-2017-13712: NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument.

Please fix them.

Created: 2017-06-28 Last update: 2018-06-02 08:03

9 ignored security issues in jessie low

There are 9 open security issues in jessie.

9 issues skipped by the security teams:

CVE-2017-9870: The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type == 2" case, a similar issue to CVE-2017-11126.
CVE-2017-9872: The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.
CVE-2017-9869: The II_step_one function in layer2.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.
CVE-2017-15018: LAME 3.99.5 has a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
CVE-2017-15046: LAME 3.99.5 has a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412.
CVE-2017-15019: LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call.
CVE-2017-9871: The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.
CVE-2017-13712: NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument.
CVE-2017-15045: LAME 3.99.5 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to lame_encode_buffer_sample_t in libmp3lame/lame.c, a different vulnerability than CVE-2017-9410.

Please fix them.

Created: 2017-06-28 Last update: 2018-06-02 08:03

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.1.4 instead of 4.1.1).

Created: 2018-04-16 Last update: 2018-06-18 01:51

news

[rss feed]

[2018-06-17] Accepted lame 3.99.5+repack1-7+deb8u2 (source amd64 all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Hugo Lefeuvre)
[2017-10-29] lame 3.100-2 MIGRATED to testing (Debian testing watch)
[2017-10-21] Accepted lame 3.100-2 (source amd64 all) into unstable (Fabian Greffrath)
[2017-10-20] Accepted lame 3.100-1 (source amd64 all) into unstable (Fabian Greffrath)
[2015-07-01] lame 3.99.5+repack1-9 MIGRATED to testing (Britney)
[2015-06-25] Accepted lame 3.99.5+repack1-9 (source amd64 all) into unstable, unstable (Fabian Greffrath)
[2015-06-23] Accepted lame 3.99.5+repack1-7+deb8u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Fabian Greffrath)
[2015-06-16] lame 3.99.5+repack1-8 MIGRATED to testing (Britney)
[2015-06-11] Accepted lame 3.99.5+repack1-8 (source amd64 all) into unstable (Fabian Greffrath)
[2015-03-24] lame 3.99.5+repack1-7 MIGRATED to testing (Britney)
[2015-02-28] Accepted lame 3.99.5+repack1-3+deb7u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Fabian Greffrath)
[2015-02-24] Accepted lame 3.99.5+repack1-7 (source amd64 all) into unstable (Fabian Greffrath)
[2015-02-15] lame 3.99.5+repack1-6 MIGRATED to testing (Britney)
[2015-02-09] Accepted lame 3.99.5+repack1-6 (source amd64 all) into unstable (Fabian Greffrath)
[2014-09-06] lame 3.99.5+repack1-5 MIGRATED to testing (Britney)
[2014-08-31] Accepted lame 3.99.5+repack1-5 (source amd64 all) into unstable (Sebastian Ramacher)
[2014-08-30] Accepted lame 3.99.5+repack1-4 (source amd64 all) into unstable (Sebastian Ramacher)
[2012-03-28] lame 3.99.5+repack1-3 MIGRATED to testing (Debian testing watch)
[2012-03-17] Accepted lame 3.99.5+repack1-3 (source all amd64) (Andres Mejia)
[2012-03-16] Accepted lame 3.99.5+repack1-2 (source all amd64) (Andres Mejia)
[2012-03-15] Accepted lame 3.99.5+repack1-1 (source all amd64) (Andres Mejia)
[2012-02-09] lame 3.99.4+repack1-1 MIGRATED to testing (Debian testing watch)
[2012-01-29] Accepted lame 3.99.4+repack1-1 (source all amd64) (Andres Mejia)
[2011-12-22] lame 3.99.3+repack1-1 MIGRATED to testing (Debian testing watch)
[2011-12-11] Accepted lame 3.99.3+repack1-1 (source all amd64) (Andres Mejia)
[2011-09-10] lame 3.98.4+repack2-6 MIGRATED to testing (Debian testing watch)
[2011-08-29] Accepted lame 3.98.4+repack2-6 (source all amd64) (Andres Mejia) (signed by: Reinhard Tartler)
[2011-08-12] lame 3.98.4+repack2-4 MIGRATED to testing (Debian testing watch)
[2011-08-02] Accepted lame 3.98.4+repack2-4 (source all amd64) (Andres Mejia)
[2011-07-30] Accepted lame 3.98.4+repack2-3 (source all amd64) (Reinhard Tartler)

bugs [bug history graph]

all: 2 3
RC: 0
I&N: 0
M&W: 2 3
F&P: 0

links

homepage
lintian (0, 3)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.100-2build1
9 bugs (1 patch)