Bug 280590 (CVE-2009-2663)

Summary:

<media-libs/libvorbis-1.2.3 vorbis_book_decodevv_add() arbitrary code execution (CVE-2009-2663)

Product:

Gentoo Security

Reporter:

Robert Buchholz (RETIRED) <rbu>

Component:

Vulnerabilities

Assignee:

Gentoo Security <security>

Status:

RESOLVED FIXED

Severity:

major

CC:

sound

Priority:

High

Version:

unspecified

Hardware:

All

OS:

Linux

URL:

https://bugzilla.mozilla.org/show_bug.cgi?id=500254

Whiteboard:

A2 [glsa]

Package list:

Runtime testing required:

---

Attachments:

Description	Flags
0001-First-half-of-fix-for-Mozilla-BZ-500254.patch	none
0002-Second-half-of-fix-to-Mozilla-BZ-5000254-sanity-chec.patch	none

Description Robert Buchholz (RETIRED) gentoo-dev

2009-08-06 19:47:51 UTC

CVE-2009-2663 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2663):
  libvorbis before r16182, as used in Mozilla Firefox before 3.0.13 and
  3.5.x before 3.5.2 and other products, allows context-dependent
  attackers to cause a denial of service (memory corruption and
  application crash) or possibly execute arbitrary code via a crafted
  .ogg file.

Comment 1 Robert Buchholz (RETIRED) gentoo-dev

2009-08-06 19:48:44 UTC

Created attachment 200418 [details, diff]
0001-First-half-of-fix-for-Mozilla-BZ-500254.patch

Comment 2 Robert Buchholz (RETIRED) gentoo-dev

2009-08-06 19:48:54 UTC

Created attachment 200419 [details, diff]
0002-Second-half-of-fix-to-Mozilla-BZ-5000254-sanity-chec.patch

Comment 3 Samuli Suominen (RETIRED) gentoo-dev

2009-08-06 20:30:28 UTC

These are in 1.2.3. I verified by checking the code line by line. It can go stable.

Comment 4 Robert Buchholz (RETIRED) gentoo-dev

2009-08-06 20:40:14 UTC

Thanks for the fast check ;-)

Comment 5 Robert Buchholz (RETIRED) gentoo-dev

2009-08-06 20:40:20 UTC

Arches, please test and mark stable:
=media-libs/libvorbis-1.2.3
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86"

Comment 6 Diego Elio Pettenò (RETIRED) gentoo-dev

2009-08-06 23:02:04 UTC

media-libs/fmod (both slots) bundle a libvorbis interfaces; whether this is libVorbis itself, tremor or nothing at all I cannot tell (since it's proprietary closed source).

Comment 7 Christian Faulhammer (RETIRED) gentoo-dev

2009-08-07 05:37:04 UTC

x86 stable

Comment 8 Brent Baude (RETIRED) gentoo-dev

2009-08-08 15:07:19 UTC

ppc64 done

Comment 9 Jeroen Roovers (RETIRED) gentoo-dev

2009-08-09 14:23:35 UTC

Stable for HPPA.

Comment 10 Tobias Klausmann (RETIRED) gentoo-dev

2009-08-10 15:45:37 UTC

Stable on alpha.

Comment 11 Markus Meier gentoo-dev

2009-08-10 22:32:13 UTC

amd64 stable

Comment 12 Raúl Porcel (RETIRED) gentoo-dev

2009-08-16 11:15:53 UTC

arm/ia64/sh/sparc stable

Comment 13 nixnut (RETIRED) gentoo-dev

2009-08-23 09:06:24 UTC

ppc stable

Comment 14 Alex Legler (RETIRED) archtester

2009-08-31 07:27:13 UTC

GLSA request filed.

Comment 15 Alex Legler (RETIRED) archtester

2009-09-07 00:59:34 UTC

GLSA 200909-02