Bug 46964 - libmad: Multiple issues (4.3)
libmad: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P3 normal (vote)
: UCS 4.3-0-errata
Assigned To: Philipp Hahn
Arvid Requate
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-05-07 06:18 CEST by Philipp Hahn
Modified: 2018-05-16 17:04 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) NVD


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philipp Hahn univentionstaff 2018-05-07 06:18:05 CEST
New Debian libmad 0.15.1b-8+deb9u1 fixes:
This update addresses the following issues:
* The mad_layer_III function in layer3.c, if NDEBUG is omitted, allows remote
  attackers to cause a denial of service (assertion failure and application
  exit) via a crafted audio file. (CVE-2017-8372)
* The mad_layer_III function in layer3.c allows remote attackers to cause a
  denial of service (heap-based buffer overflow and application crash) or
  possibly have unspecified other impact via a crafted audio file.
  (CVE-2017-8373)
* The mad_bit_skip function in bit.c allows remote attackers to cause a
  denial of service (heap-based buffer over-read and application crash) via a
  crafted audio file. (CVE-2017-8374)

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
Comment 1 Quality Assurance univentionstaff 2018-05-07 06:20:58 CEST
--- mirror/ftp/4.2/unmaintained/4.2-0/source/libmad_0.15.1b-8.dsc
+++ apt/ucs_4.3-0-errata4.3-0/source/libmad_0.15.1b-8+deb9u1.dsc
@@ -1,3 +1,15 @@
+0.15.1b-8+deb9u1 [Tue, 01 May 2018 13:20:28 +0200] Kurt Roeckx <kurt@roeckx.be>:
+
+  * Properly check the size of the main data. The previous patch
+    only checked that it could fit in the buffer, but didn't ensure there
+    was actually enough room free in the buffer. This was assigned both
+    CVE-2017-8372 and CVE-2017-8373, but they are really the same, just a
+    different way to detect it. (Closes: #287519)
+  * Rewrite patch to check the size of buffer. It now checks it before reading
+    it instead of afterwards checking that we did read too much. This now also
+    covers parsing the frame and layer3, not just layer 1 and 2. This was
+    original reported in #508133. CVE-2017-8374 mentions a case in layer 3.
+
 0.15.1b-8 [Mon, 20 May 2013 18:02:18 +0200] Kurt Roeckx <kurt@roeckx.be>:
 
   * Add multiarch support.  (Closes: #653676)
Comment 2 Arvid Requate univentionstaff 2018-05-14 19:31:33 CEST
* No UCS specific patches
* Comparison to previously shipped version ok
* Binary package update Ok
* Advisory Ok
Comment 3 Arvid Requate univentionstaff 2018-05-16 17:04:25 CEST
<http://errata.software-univention.de/ucs/4.3/55.html>