libsndfile - Debian Package Tracker

general

source: libsndfile (main)
version: 1.2.2-4
maintainer: Debian Multimedia Maintainers (archive) (DMD)
uploaders: IOhannes m zmölnig (Debian/GNU) [DMD] – Fabian Greffrath [DMD]
arch: any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.31-2
o-o-sec: 1.0.31-2+deb11u2
oldstable: 1.2.0-1+deb12u1
stable: 1.2.2-2+deb13u1
testing: 1.2.2-4
unstable: 1.2.2-4

versioned links

1.0.31-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.31-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.0-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.2-2+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.2-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libsndfile1 (2 bugs: 0, 2, 0, 0)
libsndfile1-dev (1 bugs: 0, 1, 0, 0)
sndfile-programs

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://github.com/libsndfile/libsndfile/tags failed: 500 Can't connect to github.com:443 (Temporary failure in name resolution)

Created: 2026-10-17 Last update: 2026-10-18 10:20

4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:

CVE-2024-50613: libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.
CVE-2026-37555: An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
CVE-2026-88372: libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
CVE-2026-88386: libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.

Created: 2023-07-22 Last update: 2026-10-14 15:30

4 security issues in forky high

There are 4 open security issues in forky.

4 important issues:

CVE-2024-50613: libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.
CVE-2026-37555: An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
CVE-2026-88372: libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
CVE-2026-88386: libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.

Created: 2025-08-09 Last update: 2026-10-14 15:30

4 low-priority security issues in trixie low

There are 4 open security issues in trixie.

4 issues left for the package maintainer to handle:

CVE-2024-50613: (postponed; to be fixed through a stable update) libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.
CVE-2026-37555: (needs triaging) An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
CVE-2026-88372: (postponed; to be fixed through a stable update) libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
CVE-2026-88386: (needs triaging) libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-08-09 Last update: 2026-10-14 15:30

debian/patches: 17 patches to forward upstream low

Among the 18 debian patches available in version 1.2.2-4 of the package, we noticed the following issues:

17 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-01-21 00:03

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-03-06] Accepted libsndfile 1.2.2-2+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-01-22] libsndfile 1.2.2-4 MIGRATED to testing (Debian testing watch)
[2026-01-20] Accepted libsndfile 1.2.2-4 (source) into unstable (Fabian Greffrath)
[2025-12-10] Accepted libsndfile 1.0.31-2+deb11u2 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-09-11] libsndfile 1.2.2-3 MIGRATED to testing (Debian testing watch)
[2025-09-08] Accepted libsndfile 1.2.2-3 (source) into unstable (IOhannes m zmölnig (Debian/GNU))
[2025-08-31] Accepted libsndfile 1.0.31-2+deb11u1 (source) into oldoldstable-security (Paride Legovini)
[2025-08-25] Accepted libsndfile 1.2.0-1+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2024-12-16] libsndfile 1.2.2-2 MIGRATED to testing (Debian testing watch)
[2024-12-14] Accepted libsndfile 1.2.2-2 (source) into unstable (Fabian Greffrath)
[2023-09-02] libsndfile 1.2.2-1 MIGRATED to testing (Debian testing watch)
[2023-08-30] Accepted libsndfile 1.2.2-1 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2023-01-03] libsndfile 1.2.0-1 MIGRATED to testing (Debian testing watch)
[2022-12-31] Accepted libsndfile 1.2.0-1 (source) into unstable (Dennis Braun)
[2022-10-08] libsndfile 1.1.0-3 MIGRATED to testing (Debian testing watch)
[2022-10-06] Accepted libsndfile 1.1.0-3 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2022-09-29] Accepted libsndfile 1.0.28-6+deb10u2 (source) into oldstable (Thorsten Alteholz)
[2022-09-10] libsndfile 1.1.0-2 MIGRATED to testing (Debian testing watch)
[2022-09-10] libsndfile 1.1.0-2 MIGRATED to testing (Debian testing watch)
[2022-09-08] Accepted libsndfile 1.1.0-2 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2022-09-06] Accepted libsndfile 1.1.0-1 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2022-06-26] Accepted libsndfile 1.0.27-3+deb9u3 (source amd64) into oldoldstable (Thorsten Alteholz)
[2021-08-01] libsndfile 1.0.31-2 MIGRATED to testing (Debian testing watch)
[2021-07-31] Accepted libsndfile 1.0.28-6+deb10u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2021-07-30] Accepted libsndfile 1.0.28-6+deb10u1 (source amd64) into stable->embargoed, stable (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2021-07-29] Accepted libsndfile 1.0.27-3+deb9u2 (source amd64) into oldstable (Thorsten Alteholz)
[2021-07-26] Accepted libsndfile 1.0.31-2 (source) into unstable (Sebastian Ramacher)
[2021-02-01] libsndfile 1.0.31-1 MIGRATED to testing (Debian testing watch)
[2021-01-29] Accepted libsndfile 1.0.31-1 (source) into unstable (IOhannes m zmölnig (Debian/GNU)) (signed by: IOhannes m zmölnig)
[2021-01-14] libsndfile 1.0.30-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 10
RC: 0
I&N: 10
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.2.2-4
2 bugs