SB2017112320 - Out-of-bounds read in libvorbis (Alpine package)
Published: November 23, 2017
Security Bulletin ID
SB2017112320
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2017-14160)
the vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the bark_noise_hybridmp function in psy.c due to out-of-bounds read. A remote attacker can trick the victim into opening a specially crafted mp4 file and cause the service to crash.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=7949785cc3641c3b10d47094891a572dc812c908
- https://git.alpinelinux.org/aports/commit/?id=7ef3db11e4782e5befdfc5296254950cebc733a8
- https://git.alpinelinux.org/aports/commit/?id=8b809c16866f5bb6d9311592183287272d380d83
- https://git.alpinelinux.org/aports/commit/?id=5c3a29b4196039bf3682e700f57695606a6316af
- https://git.alpinelinux.org/aports/commit/?id=027d59423eaaa922fe6544fb90de8075cf7fb257
- https://git.alpinelinux.org/aports/commit/?id=4c88d6e438038dd3f6edd42b97421d650984659a
- https://git.alpinelinux.org/aports/commit/?id=e408a1ad1a359d037188ea51cc2b0aa052218846
- https://git.alpinelinux.org/aports/commit/?id=40cdf3534fef3e22e6fbce05a34ff18b125d8ea9
- https://git.alpinelinux.org/aports/commit/?id=c42d614e4be200793b593469247613c411424a83
- https://git.alpinelinux.org/aports/commit/?id=1df48976d433e12dff80d08de2d73bc64e883519
- https://git.alpinelinux.org/aports/commit/?id=4d15b3991fd717125ab55c45ea67982ae8ec319f
- https://git.alpinelinux.org/aports/commit/?id=28c5fe5ac7c34d80d4e8e1813212c7723ae8734c
- https://git.alpinelinux.org/aports/commit/?id=4008af11053e536a49c25070d37d466f81da69ec
- https://git.alpinelinux.org/aports/commit/?id=f764a1956c2da65304e445ab88a2219378904c84
- https://git.alpinelinux.org/aports/commit/?id=713701020618a2ccdf6bad08a00caf9eca137133