From owner-freebsd-multimedia@FreeBSD.ORG Fri Mar 6 20:00:16 2009 Return-Path: Delivered-To: multimedia@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 59C721065689; Fri, 6 Mar 2009 20:00:16 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 855CE8FC26; Fri, 6 Mar 2009 20:00:09 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n26K09HL042089; Fri, 6 Mar 2009 20:00:09 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n26K09Ue042088; Fri, 6 Mar 2009 20:00:09 GMT (envelope-from gnats) Resent-Date: Fri, 6 Mar 2009 20:00:09 GMT Resent-Message-Id: <200903062000.n26K09Ue042088@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@freebsd.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Cc: multimedia@freebsd.org Resent-Reply-To: FreeBSD-gnats-submit@freebsd.org, Eygene Ryabinkin Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BDE261065670 for ; Fri, 6 Mar 2009 19:51:09 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id 74FD28FC0C for ; Fri, 6 Mar 2009 19:51:09 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from phoenix.codelabs.ru (ppp85-141-162-105.pppoe.mtu-net.ru [85.141.162.105]) by 0.mx.codelabs.ru with esmtps (TLSv1:CAMELLIA256-SHA:256) id 1Lfg4a-0006cI-3j for FreeBSD-gnats-submit@freebsd.org; Fri, 06 Mar 2009 22:51:08 +0300 Message-Id: <20090306195109.E313EB8031@phoenix.codelabs.ru> Date: Fri, 6 Mar 2009 22:51:09 +0300 (MSK) From: Eygene Ryabinkin To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.113 X-GNATS-Notify: multimedia@freebsd.org Cc: Subject: ports/132371: [vuxml] [patch] audio/libsndfile: update to 1.0.19 and fix CVE-2009-0186 X-BeenThere: freebsd-multimedia@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Eygene Ryabinkin List-Id: Multimedia discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2009 20:00:18 -0000 >Number: 132371 >Category: ports >Synopsis: [vuxml] [patch] audio/libsndfile: update to 1.0.19 and fix CVE-2009-0186 >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Mar 06 20:00:09 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Eygene Ryabinkin >Release: FreeBSD 7.1-STABLE amd64 >Organization: Code Labs >Environment: System: FreeBSD 7.1-STABLE amd64 >Description: Secunia found integer overflow in CAF processing within libsndfile 1.0.18, [1]. This could lead to the arbitrary code execution with the privileges of process that uses libsndfile to play/process the crafted CAF file. >How-To-Repeat: [1] http://secunia.com/advisories/33980/ >Fix: The following patch updates the port to 1.0.19. I had mildly tested it and found no problems. --- update-to-1.0.19.diff begins here --- >From 4f01cb69c37a0df98d0c3c3e483121bb1d944d6b Mon Sep 17 00:00:00 2001 From: Eygene Ryabinkin Date: Fri, 6 Mar 2009 22:42:50 +0300 I had tested the new port version by using sndfile-convert to transform standart .flac applaud00.flac to WAV and CAF files and transform back from these two formats to FLAC. Worked without troubles. Signed-off-by: Eygene Ryabinkin --- audio/libsndfile/Makefile | 2 +- audio/libsndfile/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/audio/libsndfile/Makefile b/audio/libsndfile/Makefile index 67c3e59..0ec8ccb 100644 --- a/audio/libsndfile/Makefile +++ b/audio/libsndfile/Makefile @@ -6,7 +6,7 @@ # PORTNAME= libsndfile -PORTVERSION= 1.0.18 +PORTVERSION= 1.0.19 CATEGORIES= audio MASTER_SITES= http://www.mega-nerd.com/libsndfile/ diff --git a/audio/libsndfile/distinfo b/audio/libsndfile/distinfo index e5f689a..5e9e5a5 100644 --- a/audio/libsndfile/distinfo +++ b/audio/libsndfile/distinfo @@ -1,3 +1,3 @@ -MD5 (libsndfile-1.0.18.tar.gz) = 9fde6efb1b75ef38398acf856f252416 -SHA256 (libsndfile-1.0.18.tar.gz) = c0821534a8510982d26b3085b148d9091dede53780733515eb49c99a65da293a -SIZE (libsndfile-1.0.18.tar.gz) = 923666 +MD5 (libsndfile-1.0.19.tar.gz) = 8fa24b0c0a8758543427c9741ea06924 +SHA256 (libsndfile-1.0.19.tar.gz) = 4b567a02e15bcae25fa1aeb3361b4e2cb8b2ce08e9b53faa81f77a34fb2b5419 +SIZE (libsndfile-1.0.19.tar.gz) = 924368 -- 1.6.1 --- update-to-1.0.19.diff ends here --- The following VuXML entry should be evaluated and added: --- vuln.xml begins here --- libsndfile -- integer overflow vulnerability in CAF processor libsndfile 1.0.19

Secunia reports:

Secunia Research has discovered a vulnerability in libsndfile, which can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to an integer overflow error in the processing of CAF description chunks. This can be exploited to cause a heap-based buffer overflow by tricking the user into processing a specially crafted CAF audio file.

Successful exploitation may allow execution of arbitrary code.

 33963 CVE-2009-0186 http://secunia.com/advisories/33980/ 2009-03-03 TODAY --- vuln.xml ends here --- >Release-Note: >Audit-Trail: >Unformatted: