SUSE-SU-2017:1182-1: moderate: Security update for audiofile

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for audiofile
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:1182-1
Rating:             moderate
References:         #1026978 #1026979 #1026980 #1026981 #1026982 
                    #1026983 #1026984 #1026985 #1026986 #1026987 
                    #1026988 
Cross-References:   CVE-2017-6827 CVE-2017-6828 CVE-2017-6829
                    CVE-2017-6830 CVE-2017-6831 CVE-2017-6832
                    CVE-2017-6833 CVE-2017-6834 CVE-2017-6835
                    CVE-2017-6836 CVE-2017-6837 CVE-2017-6838
                    CVE-2017-6839
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11-SP4
                    SUSE Linux Enterprise Server 11-SP4
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that fixes 13 vulnerabilities is now available.

Description:


   This update for audiofile fixes the following issues:

   Security issues fixed:
   - CVE-2017-6827: heap-based buffer overflow in
     MSADPCM::initializeCoefficients (MSADPCM.cpp) (bsc#1026979)
   - CVE-2017-6828: heap-based buffer overflow in readValue (FileHandle.cpp)
     (bsc#1026980)
   - CVE-2017-6829: global buffer overflow in decodeSample (IMA.cpp)
     (bsc#1026981)
   - CVE-2017-6830: heap-based buffer overflow in alaw2linear_buf (G711.cpp)
     (bsc#1026982)
   - CVE-2017-6831: heap-based buffer overflow in IMA::decodeBlockWAVE
     (IMA.cpp) (bsc#1026983)
   - CVE-2017-6832: heap-based buffer overflow in MSADPCM::decodeBlock
     (MSADPCM.cpp) (bsc#1026984)
   - CVE-2017-6833: divide-by-zero in BlockCodec::runPull (BlockCodec.cpp)
     (bsc#1026985)
   - CVE-2017-6834: heap-based buffer overflow in ulaw2linear_buf (G711.cpp)
     (bsc#1026986)
   - CVE-2017-6835: divide-by-zero in BlockCodec::reset1 (BlockCodec.cpp)
     (bsc#1026988)
   - CVE-2017-6836: heap-based buffer overflow in Expand3To4Module::run
     (SimpleModule.h) (bsc#1026987)
   - CVE-2017-6837, CVE-2017-6838, CVE-2017-6839: multiple ubsan crashes
     (bsc#1026978)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11-SP4:

      zypper in -t patch sdksp4-audiofile-13093=1

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-audiofile-13093=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-audiofile-13093=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      audiofile-devel-0.2.6-142.17.1

   - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      audiofile-0.2.6-142.17.1

   - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64):

      audiofile-32bit-0.2.6-142.17.1

   - SUSE Linux Enterprise Server 11-SP4 (ia64):

      audiofile-x86-0.2.6-142.17.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      audiofile-debuginfo-0.2.6-142.17.1
      audiofile-debugsource-0.2.6-142.17.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64):

      audiofile-debuginfo-32bit-0.2.6-142.17.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (ia64):

      audiofile-debuginfo-x86-0.2.6-142.17.1


References:

   https://www.suse.com/security/cve/CVE-2017-6827.html
   https://www.suse.com/security/cve/CVE-2017-6828.html
   https://www.suse.com/security/cve/CVE-2017-6829.html
   https://www.suse.com/security/cve/CVE-2017-6830.html
   https://www.suse.com/security/cve/CVE-2017-6831.html
   https://www.suse.com/security/cve/CVE-2017-6832.html
   https://www.suse.com/security/cve/CVE-2017-6833.html
   https://www.suse.com/security/cve/CVE-2017-6834.html
   https://www.suse.com/security/cve/CVE-2017-6835.html
   https://www.suse.com/security/cve/CVE-2017-6836.html
   https://www.suse.com/security/cve/CVE-2017-6837.html
   https://www.suse.com/security/cve/CVE-2017-6838.html
   https://www.suse.com/security/cve/CVE-2017-6839.html
   https://bugzilla.suse.com/1026978
   https://bugzilla.suse.com/1026979
   https://bugzilla.suse.com/1026980
   https://bugzilla.suse.com/1026981
   https://bugzilla.suse.com/1026982
   https://bugzilla.suse.com/1026983
   https://bugzilla.suse.com/1026984
   https://bugzilla.suse.com/1026985
   https://bugzilla.suse.com/1026986
   https://bugzilla.suse.com/1026987
   https://bugzilla.suse.com/1026988