Bugzilla Bug 186716

libvorbis 1.1.2 contains several vulnerabilities allowing heap overwrite,
read violations and a function pointer overwrite. These bugs cause a
at least a denial of service, and potentially code execution.

libvorbis-1.2.0 released upstream fixes this.

cc'ing sound@g.o

setting status. sound, please provide the updated ebuild.

The corresponding CVEs are CVE-2007-4029 and CVE-2007-3106.

Once this goes to stabling, it will probably supersede bug #155258 which is
still open for mips.

I've never touched vorbis sources or ebuild (yet) but it looks like biggest
problem doing this bump is lack of aotuv[1] patch for vorbis 1.2.0 and don't
know how backportable it is (yet)

[1] http://www.geocities.jp/aoyoume/aotuv/

aoTuV's author points out [1]:
  I don't have the plan to merge beta5 and libvorbis 1.2.0.
  It will happen by the upcoming version of aoTuV. ;-) ...

The SUSE people however did exactly that, so we could
1) update the patchset from 4.51 to beta5 with the attached patch
2) remove aotuv
3) wait for a new upstream release (last one is >1 year)

[1] http://www.hydrogenaudio.org/forums/index.php?showtopic=56415&pid=508305

Created an attachment (id=128664) [details]
libvorbis-1.2.0-aotuv-b5.diff

Porting the patch didn't change much against the b5-1.1.2, see [2] for a diff.

[2] http://lists.opensuse.org/opensuse-commit/2007-08/msg00213.html

rbu, Thanks, but still.. I don't know about others, but I'm waiting "official"
aotuv for 1.2.0 before bumping.

Security, Fixing version is 1.1.2-r1, security fixes backported from 1.2.0 by
Debian folks. It's in tree now, so archteams can test and stabilize it.

(In reply to comment #8)
> rbu, Thanks, but still.. I don't know about others, but I'm waiting "official"
> aotuv for 1.2.0 before bumping.

Actually, I meant to say.. I don't have anything against bumping it with your
suggestions.. but I just feel we shouldn't be jumping to stable with it. I
believe it should stay in ~arch for while.. same deal with flac, and other
media-libs.. They potentially break a lot of.. you know

Thanks drac.
Arches, please test and mark stable media-libs/libvorbis-1.1.2-r1.
Target keywords are:"alpha amd64 arm hppa ia64 ~mips ppc ppc64 sh sparc x86
~x86-fbsd"

(In reply to comment #9)
> Actually, I meant to say.. I don't have anything against bumping it with your
> suggestions.. but I just feel we shouldn't be jumping to stable with it. I
> believe it should stay in ~arch for while.. same deal with flac, and other
> media-libs.. They potentially break a lot of.. you know

I see your point. Would be nice to have the general bump though without having
to wait for aotuv upstream.

Also, amd64 stable.

Songs still play and encode fine

Stable on x86

Stable for HPPA.

sparc stable.

ppc stable

alpha/ia64 stable

ppc64 stable

ready for glsa decision. I didn't see that that code execution was possible, so
it could be rated B2. Anyway, I vote YES.

If I'm correct in reading this, it would require a malformed ogg vorbis file,
so this looks like a B2 to me - voting yes and submitting request.

It seems 1.2.0 fixed some more issues than mentioned here. RedHat's security
update also mentions CVE-2007-4065 and CVE-2007-4066.

You can find the issues and relevant commits/patches at their bug:
https://bugzilla.redhat.com/249780

sound, could you please verify whether our patch includes these fixes. If not,
we should prepare a new fix or stable 1.2.0.

(In reply to comment #20)
> It seems 1.2.0 fixed some more issues than mentioned here. RedHat's security
> update also mentions CVE-2007-4065 and CVE-2007-4066.
> 
> You can find the issues and relevant commits/patches at their bug:
> https://bugzilla.redhat.com/249780
> 
> sound, could you please verify whether our patch includes these fixes. If not,
> we should prepare a new fix or stable 1.2.0.
> 

it doesn't look like our patch includes fix for these, i'd say mark 1.2.0
stable and be done with it, used it in ~x86 since it was released without
issues, includes a ebuild cleanup too..

(for aotuv we have bug 157549 which we can add once aotuv upstream wakes again
and releases a tarball for 1.2.0)

Sorry to cause double work here, so please test and stabilize
media-libs/libvorbis-1.2.0.
Targets are "alpha amd64 arm hppa ia64 mips ppc ppc64 sh sparc x86"

Stable for HPPA.

ppc stable

x86 stable

amd64 stable

ppc64 stable

alpha/ia64 stable, thanks Tobias

sparc stable

GLSA 200710-03, thanks anyone.