Register | Log in

libvorbis

Choose email to subscribe with

general

source: libvorbis (source, libs)
version: 1.3.5-4
maintainer: Debian Xiph.org Maintainers (archive) [DMD]
uploaders: Martin Steghöfer [DMD] – Ralph Giles [DMD] – Petter Reinholdtsen [DMD]
arch: any
std-ver: 3.9.8
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.3.2-1.3
oldstable: 1.3.4-2
stable: 1.3.5-4
testing: 1.3.5-4
unstable: 1.3.5-4

versioned links

1.3.2-1.3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.4-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.5-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libvorbis-dbg
libvorbis-dev
libvorbis0a
libvorbisenc2
libvorbisfile3

action needed

Debci reports failed tests (log)

high

Debci reports test failures (log).

The tests ran in 0h 0m 33s

Last run: 2017-10-17 00:14:09

Previous status: fail

Created: 2017-07-27 Last update: 2017-10-24 01:29

4 security issues in sid

high

There are 4 open security issues in sid.

4 important issues:

CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2017-11333: The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.
CVE-2017-14632: Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.
CVE-2017-14633: In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().

Please fix them.

Created: 2017-08-01 Last update: 2017-10-09 07:21

3 security issues in wheezy

high

There are 3 open security issues in wheezy.

3 important issues:

CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2017-11333: The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.
CVE-2017-14633: In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().

Please fix them.

Created: 2017-08-01 Last update: 2017-10-09 07:21

4 security issues in buster

high

There are 4 open security issues in buster.

4 important issues:

CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2017-11333: The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.
CVE-2017-14632: Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.
CVE-2017-14633: In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().

Please fix them.

Created: 2017-08-01 Last update: 2017-10-09 07:21

3 security issues in jessie

high

There are 3 open security issues in jessie.

2 important issues:

CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2017-14633: In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().

1 issue skipped by the security teams:

CVE-2017-11333: The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Please fix them.

Created: 2017-08-01 Last update: 2017-10-09 07:21

4 security issues in stretch

high

There are 4 open security issues in stretch.

3 important issues:

CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2017-14632: Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.
CVE-2017-14633: In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().

1 issue skipped by the security teams:

CVE-2017-11333: The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Please fix them.

Created: 2017-08-01 Last update: 2017-10-09 07:21

lintian reports 3 warnings

normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2017-09-24 Last update: 2017-10-16 07:17

Build log checks report 1 warning

low

Build log checks report 1 warning

Created: 2014-07-02 Last update: 2014-08-31 18:13

news

[2017-01-02] libvorbis 1.3.5-4 MIGRATED to testing (Debian testing watch)
[2016-12-22] Accepted libvorbis 1.3.5-4 (source) into unstable (Petter Reinholdtsen)
[2016-02-17] libvorbis 1.3.5-3 MIGRATED to testing (Debian testing watch)
[2016-02-11] Accepted libvorbis 1.3.5-3 (source) into unstable (Petter Reinholdtsen)
[2016-02-07] Accepted libvorbis 1.3.5-2 (source) into unstable (Petter Reinholdtsen)
[2016-02-06] Accepted libvorbis 1.3.5-1 (source) into unstable (Petter Reinholdtsen)
[2015-10-03] libvorbis 1.3.4-3 MIGRATED to testing (Britney)
[2015-09-22] Accepted libvorbis 1.3.4-3 (source) into unstable (Petter Reinholdtsen) (signed by: Matteo F. Vescovi)
[2014-11-15] libvorbis 1.3.4-2 MIGRATED to testing (Britney)
[2014-11-04] libvorbis 1.3.4-1 MIGRATED to testing (Britney)
[2014-11-04] Accepted libvorbis 1.3.4-2 (source amd64) into unstable (Petter Reinholdtsen)
[2014-10-24] Accepted libvorbis 1.3.4-1 (source amd64) into unstable (Petter Reinholdtsen)
[2014-10-24] libvorbis 1.3.2-1.5 MIGRATED to testing (Britney)
[2014-10-24] Accepted libvorbis 1.3.2-2 (source amd64) into unstable (Petter Reinholdtsen)
[2014-10-14] Accepted libvorbis 1.3.2-1.5 (source amd64) into unstable (Petter Reinholdtsen)
[2014-06-01] libvorbis 1.3.2-1.4 MIGRATED to testing (Debian testing watch)
[2014-05-21] Accepted libvorbis 1.3.2-1.4 (source amd64) (Manuel A. Fernandez Montecelo)
[2012-05-18] libvorbis 1.3.2-1.3 MIGRATED to testing (Debian testing watch)
[2012-05-07] Accepted libvorbis 1.3.2-1.3 (source amd64) (Riku Voipio)
[2012-04-22] libvorbis 1.3.2-1.2 MIGRATED to testing (Debian testing watch)
[2012-04-20] Accepted libvorbis 1.3.2-1.2 (source amd64) (Michael Gilbert)
[2012-02-20] Accepted libvorbis 1.3.1-1+squeeze1 (source amd64) (Moritz Muehlenhoff)
[2012-01-21] libvorbis 1.3.2-1.1 MIGRATED to testing (Debian testing watch)
[2012-01-10] Accepted libvorbis 1.3.2-1.1 (source amd64) (HIGUCHI Daisuke (VDR dai)) (signed by: HIGUCHI Daisuke)
[2011-02-26] libvorbis 1.3.2-1 MIGRATED to testing (Debian testing watch)
[2011-02-15] Accepted libvorbis 1.3.2-1 (source amd64) (John Francesco Ferlito)
[2010-04-14] libvorbis 1.3.1-1 MIGRATED to testing (Debian testing watch)
[2010-04-03] Accepted libvorbis 1.3.1-1 (source i386) (John Francesco Ferlito)
[2009-12-05] Accepted libvorbis 1.1.2.dfsg-1.4+etch1 (source i386) (Giuseppe Iuculano)
[2009-12-05] Accepted libvorbis 1.2.0.dfsg-3.1+lenny1 (source i386) (Giuseppe Iuculano)

1
2

bugs [bug history graph]

all: 7
RC: 0
I&N: 7
M&W: 0
F&P: 0

links

homepage
lintian (0, 3)
buildd: logs, checks, clang, reproducibility
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.3.5-4
3 bugs (1 patch)

Debian Package Tracker — Copyright 2013-2016 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Git Repository — How to contribute