File _patchinfo of Package patchinfo.4961

<patchinfo incident="4961">
  <packager>tiwai</packager>
  <issue tracker="bnc" id="1069874">VUL-1: CVE-2017-16942: libsndfile: Divide-by-zero in the function wav_w64_read_fmt_chunk(), which may lead to DoS</issue>
  <issue tracker="bnc" id="1043978">VUL-0: CVE-2017-6892: libsndfile: out-of-bounds read memory access in the "aiff_read_chanmap()" function</issue>
  <issue tracker="cve" id="2017-16942"></issue>
  <issue tracker="cve" id="2017-6892"></issue>
  <issue tracker="bnc" id="1059911">VUL-0: CVE-2017-14634: libsndfile: divide-by-zero error exists in the function double64_init() in double64.c</issue>
  <issue tracker="bnc" id="1059912">VUL-0: CVE-2017-14245: libsndfile: out of bounds read in the function d2alaw_array() in alaw.c</issue>
  <issue tracker="bnc" id="1059913">VUL-0: CVE-2017-14246: libsndfile: out of bounds read in the function d2ulaw_array() in ulaw.c</issue>
  <issue tracker="cve" id="2017-14634"></issue>
  <issue tracker="cve" id="2017-14245"></issue>
  <issue tracker="cve" id="2017-14246"></issue>
  <category>security</category>
  <rating>moderate</rating>
  <summary>Security update for libsndfile</summary>
  <description>This update for libsndfile fixes the following issues:

- CVE-2017-16942: Divide-by-zero in the function wav_w64_read_fmt_chunk(), which may lead to Denial of service (bsc#1069874). 
- CVE-2017-6892:  Fixed an out-of-bounds read memory access in the aiff_read_chanmap() (bsc#1043978).
- CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file. (bsc#1059911)
- CVE-2017-14245: An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of 
                  the NAN and INFINITY floating-point values. (bsc#1059912)
- CVE-2017-14246: An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of 
                  the NAN and INFINITY floating-point values.(bsc#1059913)
</description>
</patchinfo>
Places

File _patchinfo of Package patchinfo.4961

Places
