Debian Package Tracker

general

source: libsndfile (main)
version: 1.0.28-4
maintainer: Debian Multimedia Maintainers (archive) [DMD]
uploaders: IOhannes m zmölnig (Debian/GNU) [DMD]
arch: any
std-ver: 4.0.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.25-5
o-o-sec: 1.0.25-9.1+deb7u4
oldstable: 1.0.25-9.1+deb8u1
stable: 1.0.27-3
testing: 1.0.28-4
unstable: 1.0.28-4

versioned links

1.0.25-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.25-9.1+deb7u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.25-9.1+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.27-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.28-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libsndfile1
libsndfile1-dev
sndfile-programs

action needed

9 security issues in sid high

There are 9 open security issues in sid.

9 important issues:

CVE-2017-17457: The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14246.
CVE-2017-14246: An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVE-2018-19662: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.
CVE-2017-14245: An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVE-2018-19661: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service.
CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file.
CVE-2018-13419: An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c, as demonstrated by sndfile-convert.
CVE-2018-19432: An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function sf_write_int in sndfile.c, which will lead to a denial of service.
CVE-2017-17456: The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14245.

Please fix them.

Created: 2017-09-21 Last update: 2018-12-01 05:35

9 security issues in buster high

There are 9 open security issues in buster.

9 important issues:

CVE-2017-17457: The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14246.
CVE-2017-14246: An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVE-2018-19662: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.
CVE-2017-14245: An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVE-2018-19661: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service.
CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file.
CVE-2018-13419: An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c, as demonstrated by sndfile-convert.
CVE-2018-19432: An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function sf_write_int in sndfile.c, which will lead to a denial of service.
CVE-2017-17456: The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14245.

Please fix them.

Created: 2017-09-21 Last update: 2018-12-01 05:35

20 security issues in jessie high

There are 20 open security issues in jessie.

3 important issues:

CVE-2018-19661: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service.
CVE-2018-19662: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.
CVE-2018-19432: An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function sf_write_int in sndfile.c, which will lead to a denial of service.

17 issues skipped by the security teams:

CVE-2017-8365: The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.
CVE-2017-8361: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.
CVE-2017-8363: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
CVE-2017-6892: In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.
CVE-2017-14246: An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVE-2017-16942: In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead to DoS when playing a crafted audio file.
CVE-2017-17457: The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14246.
CVE-2017-7741: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
CVE-2017-8362: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file.
CVE-2018-13419: An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c, as demonstrated by sndfile-convert.
CVE-2017-14245: An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVE-2017-7742: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file.
CVE-2017-7585: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
CVE-2017-7586: In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
CVE-2017-12562: Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVE-2017-17456: The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14245.

Please fix them.

Created: 2017-04-08 Last update: 2018-12-01 05:35

3 new commits since last upload, time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit f29fb3a73a8d41aa943f9335426f981277d73daf
Author: Felipe Sateler <fsateler@debian.org>
Date:   Mon Apr 16 13:54:48 2018 -0300

    Change maintainer address to debian-multimedia@lists.debian.org

commit c402da13e9a4c0c5bf11c71ce760a224c50f33b5
Author: Ondřej Nový <onovy@debian.org>
Date:   Mon Mar 12 23:35:38 2018 +0100

    d/changelog: Remove trailing whitespaces

commit 0ac0d7d2f0aff8bf710cba51b789b6b7f432e519
Author: Ondřej Nový <onovy@debian.org>
Date:   Mon Feb 19 10:15:13 2018 +0100

    d/control: Set Vcs-* to salsa.debian.org

The Vcs URL is using anonscm.debian.org. Please update it for the move to salsa.debian.org.

Created: 2018-02-19 Last update: 2018-12-11 22:29

lintian reports 8 warnings normal

Lintian reports 8 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2017-07-27 Last update: 2018-09-10 05:07

11 ignored security issues in stretch low

There are 11 open security issues in stretch.

11 issues skipped by the security teams:

CVE-2017-17457: The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14246.
CVE-2017-14246: An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVE-2018-19662: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.
CVE-2017-17456: The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address 0x000000000000), a different vulnerability than CVE-2017-14245.
CVE-2018-19661: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service.
CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file.
CVE-2018-13419: An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c, as demonstrated by sndfile-convert.
CVE-2017-6892: In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.
CVE-2017-12562: Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVE-2018-19432: An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function sf_write_int in sndfile.c, which will lead to a denial of service.
CVE-2017-14245: An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.

Please fix them.

Created: 2017-06-13 Last update: 2018-12-01 05:35

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.2.1 instead of 4.0.1).

Created: 2018-04-16 Last update: 2018-08-26 08:16

news

[rss feed]

[2017-08-22] libsndfile 1.0.28-4 MIGRATED to testing (Debian testing watch)
[2017-08-17] Accepted libsndfile 1.0.28-4 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2017-08-07] Accepted libsndfile 1.0.25-9.1+deb7u4 (source amd64) into oldoldstable (Chris Lamb)
[2017-07-18] libsndfile 1.0.28-3 MIGRATED to testing (Debian testing watch)
[2017-07-12] Accepted libsndfile 1.0.28-3 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2017-06-26] libsndfile 1.0.28-2 MIGRATED to testing (Debian testing watch)
[2017-06-20] Accepted libsndfile 1.0.28-2 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2017-06-20] Accepted libsndfile 1.0.28-1 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2017-06-15] Accepted libsndfile 1.0.25-9.1+deb7u3 (source amd64) into oldstable (Chris Lamb)
[2017-05-31] libsndfile 1.0.27-3 MIGRATED to testing (Debian testing watch)
[2017-05-28] Accepted libsndfile 1.0.27-3 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2017-05-28] Accepted libsndfile 1.0.25-9.1+deb7u2 (source amd64) into oldstable (Thorsten Alteholz)
[2017-04-29] Accepted libsndfile 1.0.25-9.1+deb7u1 (source amd64) into oldstable (Antoine Beaupré)
[2017-04-07] libsndfile 1.0.27-2 MIGRATED to testing (Debian testing watch)
[2017-04-04] Accepted libsndfile 1.0.27-2 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2016-10-16] libsndfile 1.0.27-1 MIGRATED to testing (Debian testing watch)
[2016-10-05] Accepted libsndfile 1.0.27-1 (source amd64) into unstable (Erik de Castro Lopo) (signed by: IOhannes m zmölnig)
[2016-03-24] Accepted libsndfile 1.0.25-9.1+deb8u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Moritz Mühlenhoff)
[2015-11-30] Accepted libsndfile 1.0.21-3+squeeze2 (source i386) into squeeze-lts (Thorsten Alteholz)
[2015-11-21] libsndfile 1.0.25-10 MIGRATED to testing (Britney)
[2015-11-11] Accepted libsndfile 1.0.25-10 (source amd64) into unstable (Erik de Castro Lopo) (signed by: Simon Horman)
[2015-02-02] libsndfile 1.0.25-9.1 MIGRATED to testing (Britney)
[2015-01-31] Accepted libsndfile 1.0.25-9.1 (source) into unstable (Michael Gilbert)
[2014-02-09] libsndfile 1.0.25-9 MIGRATED to testing (Debian testing watch)
[2014-01-29] Accepted libsndfile 1.0.25-9 (source amd64) (Erik de Castro Lopo)
[2014-01-29] libsndfile 1.0.25-8 MIGRATED to testing (Debian testing watch)
[2014-01-19] Accepted libsndfile 1.0.25-8 (source amd64) (Erik de Castro Lopo)
[2013-07-26] libsndfile 1.0.25-7 MIGRATED to testing (Debian testing watch)
[2013-07-16] Accepted libsndfile 1.0.25-7 (source amd64) (Erik de Castro Lopo) (signed by: Simon Horman)
[2013-07-08] libsndfile 1.0.25-6 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 8
RC: 0
I&N: 7
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 8)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.0.28-4
8 bugs