Bug 914450 (CVE-2022-33064, CVE-2022-33065)

Summary:	media-libs/libsndfile: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	sound
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-09-20 03:38:20 UTC

CVE-2022-33065 (https://github.com/libsndfile/libsndfile/issues/833):
Closed as a dupe: https://github.com/libsndfile/libsndfile/issues/789

Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other unspecified impacts.

CVE-2022-33064 (https://github.com/libsndfile/libsndfile/issues/832):

An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.