Debian Package Tracker

general

source: libvorbis (main)
version: 1.3.6-1
maintainer: Debian Xiph.org Maintainers (archive) [DMD]
uploaders: Petter Reinholdtsen [DMD] – Ralph Giles [DMD] – Martin Steghöfer [DMD]
arch: any
std-ver: 4.1.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.3.2-1.3
o-o-sec: 1.3.2-1.3+deb7u1
oldstable: 1.3.4-2+deb8u1
old-sec: 1.3.4-2+deb8u1
stable: 1.3.5-4+deb9u2
stable-sec: 1.3.5-4+deb9u2
testing: 1.3.6-1
unstable: 1.3.6-1

versioned links

1.3.2-1.3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.2-1.3+deb7u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.4-2+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.5-4+deb9u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libvorbis-dev
libvorbis0a
libvorbisenc2
libvorbisfile3

action needed

Debci reports failed tests (log) high

Debci reports test failures (log).

The tests ran in 0h 0m 41s

Last run: 2018-11-01 18:56:30

Previous status: fail

Created: 2018-01-30 Last update: 2018-11-12 21:58

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

fatal: repository 'https://anonscm.debian.org/git/pkg-xiph/libvorbis.git/' not found

Created: 2018-05-31 Last update: 2018-11-12 02:40

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2018-10393: bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
CVE-2018-10392: mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

Please fix them.

Created: 2017-08-01 Last update: 2018-08-11 08:05

3 security issues in buster high

There are 3 open security issues in buster.

3 important issues:

CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2018-10393: bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
CVE-2018-10392: mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

Please fix them.

Created: 2017-08-01 Last update: 2018-08-11 08:05

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-11 Last update: 2018-09-12 08:20

The URL(s) for this package had some recent persistent issues low

DUCK reports some issues concerning upstream URLs defined for this package.

Created: 2018-09-07 Last update: 2018-11-12 20:48

5 ignored security issues in jessie low

There are 5 open security issues in jessie.

5 issues skipped by the security teams:

CVE-2017-11333: The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.
CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2017-14633: In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().
CVE-2018-10393: bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
CVE-2018-10392: mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

Please fix them.

Created: 2017-08-01 Last update: 2018-08-11 08:05

3 ignored security issues in stretch low

There are 3 open security issues in stretch.

3 issues skipped by the security teams:

CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVE-2018-10393: bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
CVE-2018-10392: mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

Please fix them.

Created: 2017-08-01 Last update: 2018-08-11 08:05

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2014-07-02 Last update: 2014-08-31 18:13

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.2.1 instead of 4.1.3).

Created: 2018-04-16 Last update: 2018-08-26 08:17

news

[rss feed]

[2018-04-30] Accepted libvorbis 1.3.2-1.3+deb7u1 (source amd64) into oldoldstable (Antoine Beaupré)
[2018-03-27] libvorbis 1.3.6-1 MIGRATED to testing (Debian testing watch)
[2018-03-22] Accepted libvorbis 1.3.6-1 (source) into unstable (Petter Reinholdtsen)
[2018-03-22] libvorbis 1.3.5-4.2 MIGRATED to testing (Debian testing watch)
[2018-03-17] Accepted libvorbis 1.3.4-2+deb8u1 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Salvatore Bonaccorso)
[2018-03-17] Accepted libvorbis 1.3.5-4+deb9u2 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2018-03-17] Accepted libvorbis 1.3.5-4+deb9u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2018-03-17] Accepted libvorbis 1.3.5-4.2 (source) into unstable (Salvatore Bonaccorso)
[2018-03-16] Accepted libvorbis 1.3.5-4+deb9u2 (source) into stable->embargoed, stable (Salvatore Bonaccorso)
[2018-03-16] Accepted libvorbis 1.3.4-2+deb8u1 (source) into oldstable->embargoed, oldstable (Salvatore Bonaccorso)
[2018-01-02] libvorbis 1.3.5-4.1 MIGRATED to testing (Debian testing watch)
[2017-12-27] Accepted libvorbis 1.3.5-4.1 (source) into unstable (Guido Günther)
[2017-01-02] libvorbis 1.3.5-4 MIGRATED to testing (Debian testing watch)
[2016-12-22] Accepted libvorbis 1.3.5-4 (source) into unstable (Petter Reinholdtsen)
[2016-02-17] libvorbis 1.3.5-3 MIGRATED to testing (Debian testing watch)
[2016-02-11] Accepted libvorbis 1.3.5-3 (source) into unstable (Petter Reinholdtsen)
[2016-02-07] Accepted libvorbis 1.3.5-2 (source) into unstable (Petter Reinholdtsen)
[2016-02-06] Accepted libvorbis 1.3.5-1 (source) into unstable (Petter Reinholdtsen)
[2015-10-03] libvorbis 1.3.4-3 MIGRATED to testing (Britney)
[2015-09-22] Accepted libvorbis 1.3.4-3 (source) into unstable (Petter Reinholdtsen) (signed by: Matteo F. Vescovi)
[2014-11-15] libvorbis 1.3.4-2 MIGRATED to testing (Britney)
[2014-11-04] libvorbis 1.3.4-1 MIGRATED to testing (Britney)
[2014-11-04] Accepted libvorbis 1.3.4-2 (source amd64) into unstable (Petter Reinholdtsen)
[2014-10-24] Accepted libvorbis 1.3.4-1 (source amd64) into unstable (Petter Reinholdtsen)
[2014-10-24] libvorbis 1.3.2-1.5 MIGRATED to testing (Britney)
[2014-10-24] Accepted libvorbis 1.3.2-2 (source amd64) into unstable (Petter Reinholdtsen)
[2014-10-14] Accepted libvorbis 1.3.2-1.5 (source amd64) into unstable (Petter Reinholdtsen)
[2014-06-01] libvorbis 1.3.2-1.4 MIGRATED to testing (Debian testing watch)
[2014-05-21] Accepted libvorbis 1.3.2-1.4 (source amd64) (Manuel A. Fernandez Montecelo)
[2012-05-18] libvorbis 1.3.2-1.3 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 4
RC: 1
I&N: 3
M&W: 0
F&P: 0
patch: 0

links

homepage
buildd: logs, checks, clang, reproducibility
popcon
debci
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.3.6-1
5 bugs (1 patch)