Test ID:	1.3.6.1.4.1.25623.1.0.890956
Category:	Debian Local Security Checks
Title:	Debian LTS: Security Advisory for libsndfile (DLA-956-1)
Summary:	CVE-2017-8361;The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows;remote attackers to cause a denial of service (buffer overflow and;application crash) or possibly have unspecified other impact via a;crafted audio file.;;CVE-2017-8362;The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows;remote attackers to cause a denial of service (invalid read and;application crash) via a crafted audio file.;;CVE-2017-8363;The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows;remote attackers to cause a denial of service (heap-based buffer;over-read and application crash) via a crafted audio file.;;CVE-2017-8365;The i2les_array function in pcm.c in libsndfile 1.0.28 allows;remote attackers to cause a denial of service (buffer over-read;and application crash) via a crafted audio file.
Description:	Summary: CVE-2017-8361 The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file. CVE-2017-8362 The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file. CVE-2017-8363 The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file. CVE-2017-8365 The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file. Affected Software/OS: libsndfile on Debian Linux Solution: For Debian 7 'Wheezy', these problems have been fixed in version 1.0.25-9.1+deb7u2. We recommend that you upgrade your libsndfile packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-8361 https://security.gentoo.org/glsa/201811-23 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/ https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html Common Vulnerability Exposure (CVE) ID: CVE-2017-8362 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/ Common Vulnerability Exposure (CVE) ID: CVE-2017-8363 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/ Common Vulnerability Exposure (CVE) ID: CVE-2017-8365 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/
Copyright	Copyright (C) 2018 Greenbone Networks GmbH http://greenbone.net

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.