sox - Debian Package Tracker

general

source: sox (main)
version: 14.4.2+git20190427-3
maintainer: Debian Multimedia Maintainers (archive) (DMD)
uploaders: Jaromír Mikeš [DMD] – Dennis Braun [DMD]
arch: any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 14.4.1-5+deb9u2
oldstable: 14.4.2+git20190427-1
stable: 14.4.2+git20190427-2
testing: 14.4.2+git20190427-3
unstable: 14.4.2+git20190427-3

versioned links

14.4.1-5+deb9u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
14.4.2+git20190427-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
14.4.2+git20190427-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
14.4.2+git20190427-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libsox-dev
libsox-fmt-all
libsox-fmt-alsa
libsox-fmt-ao
libsox-fmt-base (1 bugs: 0, 1, 0, 0)
libsox-fmt-mp3
libsox-fmt-oss
libsox-fmt-pulse
libsox3
sox (10 bugs: 0, 4, 6, 0)

action needed

8 security issues in sid high

There are 8 open security issues in sid.

8 important issues:

CVE-2021-3643: A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information.
CVE-2021-23159: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to crash.
CVE-2021-23172: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash.
CVE-2021-23210: A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause an application to crash.
CVE-2021-33844: A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash.
CVE-2021-40426: A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2022-31650: In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
CVE-2022-31651: In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.

Created: 2022-07-04 Last update: 2022-10-02 19:30

9 security issues in buster high

There are 9 open security issues in buster.

4 important issues:

CVE-2021-23159: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to crash.
CVE-2021-23172: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash.
CVE-2021-33844: A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash.
CVE-2021-40426: A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

4 issues postponed or untriaged:

CVE-2021-3643: (needs triaging) A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information.
CVE-2021-23210: (needs triaging) A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause an application to crash.
CVE-2022-31650: (needs triaging) In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
CVE-2022-31651: (needs triaging) In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.

1 ignored issue:

CVE-2019-13590: An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function), there is an integer overflow on the result of integer addition (wraparound to 0) fed into the lsx_calloc macro that wraps malloc. When a NULL pointer is returned, it is used without a prior check that it is a valid pointer, leading to a NULL pointer dereference on lsx_readbuf in formats_i.c.

Created: 2022-07-04 Last update: 2022-10-02 19:30

8 security issues in bullseye high

There are 8 open security issues in bullseye.

4 important issues:

CVE-2021-23159: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to crash.
CVE-2021-23172: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash.
CVE-2021-33844: A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash.
CVE-2021-40426: A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

4 issues left for the package maintainer to handle:

CVE-2021-3643: (needs triaging) A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information.
CVE-2021-23210: (needs triaging) A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause an application to crash.
CVE-2022-31650: (needs triaging) In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
CVE-2022-31651: (needs triaging) In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.

You can find information about how to handle these issues in the security team's documentation.

Created: 2022-07-04 Last update: 2022-10-02 19:30

8 security issues in bookworm high

There are 8 open security issues in bookworm.

8 important issues:

CVE-2021-3643: A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information.
CVE-2021-23159: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to crash.
CVE-2021-23172: A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash.
CVE-2021-23210: A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause an application to crash.
CVE-2021-33844: A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash.
CVE-2021-40426: A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2022-31650: In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
CVE-2022-31651: In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.

Created: 2022-07-04 Last update: 2022-10-02 19:30

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2022-09-22 Last update: 2023-02-01 16:33

5 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 9d127a03479bf8880a5760b84d620d8686b13fa4
Merge: aea82b1 5fea05f
Author: Dennis Braun <d_braun@kabelmail.de>
Date:   Sun Nov 27 14:02:31 2022 +0000

    Merge branch 'scrub-obsolete' into 'master'
    
    Remove unnecessary constraints
    
    See merge request multimedia-team/sox!3

commit aea82b16f96cea2ac3596926302011a1efbec200
Merge: 02c70c8 dbfb319
Author: Dennis Braun <d_braun@kabelmail.de>
Date:   Sun Nov 27 14:01:47 2022 +0000

    Merge branch 'lintian-fixes' into 'master'
    
    Fix some issues reported by lintian
    
    See merge request multimedia-team/sox!2

commit 5fea05fca5569fc4208223ebfce855a23c228f38
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Wed Nov 9 14:47:17 2022 +0000

    Remove constraints unnecessary since buster (oldstable)
    
    * Build-Depends: Drop versioned constraint on libsndfile1-dev.
    
    Changes-By: deb-scrub-obsolete

commit dbfb319c8d877ed847715125c55fa536b89c89bc
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Sat Oct 1 17:30:20 2022 +0000

    Avoid explicitly specifying -Wl,--as-needed linker flag.
    
    Changes-By: lintian-brush
    Fixes: lintian: debian-rules-uses-as-needed-linker-flag
    See-also: https://lintian.debian.org/tags/debian-rules-uses-as-needed-linker-flag.html

commit 50ce88c9cd55652bdcaefbda29ead6b3f723d40e
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Sat Oct 1 17:29:26 2022 +0000

    Update standards version to 4.6.1, no changes needed.
    
    Changes-By: lintian-brush
    Fixes: lintian: out-of-date-standards-version
    See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

Created: 2022-11-27 Last update: 2023-01-29 04:45

lintian reports 46 warnings normal

Lintian reports 46 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2022-10-23 Last update: 2022-10-23 23:34

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2016-04-07 Last update: 2016-04-07 19:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.2 instead of 4.6.0).

Created: 2022-05-11 Last update: 2022-12-17 19:17

news

[rss feed]

[2022-04-11] sox 14.4.2+git20190427-3 MIGRATED to testing (Debian testing watch)
[2022-04-06] Accepted sox 14.4.2+git20190427-3 (source) into unstable (Sebastian Ramacher)
[2020-02-14] sox 14.4.2+git20190427-2 MIGRATED to testing (Debian testing watch)
[2020-02-09] Accepted sox 14.4.2+git20190427-2 (source) into unstable (Dennis Braun) (signed by: Sebastian Ramacher)
[2019-08-23] Accepted sox 14.4.1-5+deb9u2 (source amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Moritz Mühlenhoff)
[2019-05-28] Accepted sox 14.4.1-5+deb8u4 (source amd64) into oldstable (Emilio Pozuelo Monfort)
[2019-05-03] sox 14.4.2+git20190427-1 MIGRATED to testing (Debian testing watch)
[2019-04-27] Accepted sox 14.4.2+git20190427-1 (source amd64) into unstable (Tiago Bortoletto Vaz)
[2019-03-05] Accepted sox 14.4.1-5+deb8u3 (source amd64) into oldstable (Hugo Lefeuvre)
[2019-02-28] Accepted sox 14.4.1-5+deb8u2 (source amd64) into oldstable (Hugo Lefeuvre)
[2019-02-24] Accepted sox 14.4.1-5+deb8u1 (source amd64) into oldstable (Adrian Bunk)
[2019-02-04] Accepted sox 14.4.1-5+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2017-12-24] sox 14.4.2-3 MIGRATED to testing (Debian testing watch)
[2017-12-18] Accepted sox 14.4.2-3 (source) into unstable (Jaromír Mikeš)
[2017-11-30] Accepted sox 14.4.0-3+deb7u2 (source amd64) into oldoldstable (Markus Koschany)
[2017-11-29] sox 14.4.2-2 MIGRATED to testing (Debian testing watch)
[2017-11-24] Accepted sox 14.4.2-2 (source) into unstable (Jaromír Mikeš)
[2017-11-19] Accepted sox 14.4.2-1 (source amd64) into experimental, experimental (Jaromír Mikeš) (signed by: Sebastian Ramacher)
[2015-01-03] Accepted sox 14.3.1-1+deb6u1 (source i386) into squeeze-lts (Thorsten Alteholz)
[2014-12-30] sox 14.4.1-5 MIGRATED to testing (Britney)
[2014-12-24] Accepted sox 14.4.1-5 (source amd64) into unstable (Pascal Giard)
[2014-12-24] Accepted sox 14.4.0-3+deb7u1 (source) into proposed-updates->stable-new, proposed-updates (Pascal Giard)
[2014-06-01] sox 14.4.1-4 MIGRATED to testing (Debian testing watch)
[2014-05-22] Accepted sox 14.4.1-4 (source amd64) (Pascal Giard)
[2013-05-05] sox 14.4.1-3 MIGRATED to testing (Debian testing watch)
[2013-04-16] Accepted sox 14.4.1-3 (source amd64) (Pascal Giard)
[2013-02-23] Accepted sox 14.4.1-2 (source amd64) (Pascal Giard)
[2013-02-12] Accepted sox 14.4.1-1 (source amd64) (Pascal Giard)
[2013-01-19] Accepted sox 14.4.0-5 (source amd64) (Pascal Giard)
[2013-01-18] Accepted sox 14.4.0-4 (source amd64) (Pascal Giard)

bugs [bug history graph]

all: 20
RC: 1
I&N: 12
M&W: 7
F&P: 0
patch: 1

links

homepage
lintian (0, 46)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 14.4.2+git20190427-3build1
4 bugs