| Summary: | <media-libs/game-music-emu-0.6.1: Multiple issues due to incorrect emulation of the SPC700 audio co-processor of SNES | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | galtgendo, sound |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1405423 | ||
| See Also: | https://bugs.gentoo.org/show_bug.cgi?id=618346 | ||
| Whiteboard: | B2 [glsa cve] | ||
| Package list: |
=media-libs/game-music-emu-0.6.1
|
Runtime testing required: | --- |
| Bug Depends on: | |||
| Bug Blocks: | 620516 | ||
@ Maintainer(s): Please bump to >=media-libs/game-music-emu-0.6.1 *** Bug 611040 has been marked as a duplicate of this bug. *** commit 146d393d3bea760ce75f424897db6798310eed2b Author: Alexis Ballier <aballier@gentoo.org> Date: Mon Feb 27 10:38:45 2017 +0100 media-libs/game-music-emu: Bump to 0.6.1, bug #603092 I think it can go stable Stable on alpha. arm stable amd64 stable x86 stable Stable for HPPA PPC64. ppc stable, last arch. Arches, Thank you for your work. New GLSA Request filed. Maintainer(s), please drop the vulnerable version(s). Maintainer(s), please drop the vulnerable version(s). Maintainer(s), please drop the vulnerable version(s). Arches and Maintainer(s), Thank you for your work. Freeing aliases for tracker bug usage. This issue was resolved and addressed in GLSA 201707-02 at https://security.gentoo.org/glsa/201707-02 by GLSA coordinator Thomas Deutschmann (whissi). |
From ${URL} : Incorrect emulation of the SPC700 audio co-processor of the Super Nintendo Entertainment System allows the execution of arbitrary code if a malformed SPC music file is opened. References: http://scarybeastsecurity.blogspot.cz/2016/12/redux-compromising-linux-using-snes.html http://seclists.org/oss-sec/2016/q4/682 CVE assignments: http://seclists.org/oss-sec/2016/q4/692 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.