PublicDateAtUSN: 2017-04-30
Candidate: CVE-2017-8362
PublicDate: 2017-04-30 19:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8362
 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/
 https://ubuntu.com/security/notices/USN-3306-1
Description:
 The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote
 attackers to cause a denial of service (invalid read and application crash)
 via a crafted audio file.
Ubuntu-Description:
Notes:
Bugs:
 https://github.com/erikd/libsndfile/issues/231
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862204
Priority: low
Discovered-by: Agostino Sarubbo
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [6.5 MEDIUM]

Patches_libsndfile:
 upstream: https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808
upstream_libsndfile: released (1.0.27-3)
precise_libsndfile: ignored (reached end-of-life)
precise/esm_libsndfile: DNE (precise was needed)
trusty_libsndfile: released (1.0.25-7ubuntu2.2)
trusty/esm_libsndfile: released (1.0.25-7ubuntu2.2)
vivid/stable-phone-overlay_libsndfile: ignored (reached end-of-life)
vivid/ubuntu-core_libsndfile: DNE
xenial_libsndfile: released (1.0.25-10ubuntu0.16.04.1)
esm-infra/xenial_libsndfile: released (1.0.25-10ubuntu0.16.04.1)
yakkety_libsndfile: released (1.0.25-10ubuntu0.16.10.1)
zesty_libsndfile: released (1.0.27-1ubuntu0.1)
devel_libsndfile: not-affected (1.0.27-3)