Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 530288 (CVE-2014-8962) - <media-libs/flac-1.3.1-r1: Stack-based buffer overflow in stream_decoder.c (CVE-2014-8962)
Summary: <media-libs/flac-1.3.1-r1: Stack-based buffer overflow in stream_decoder.c (C...
Status: RESOLVED FIXED
Alias: CVE-2014-8962
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: A2 [glsa]
Keywords:
Depends on: 530920
Blocks:
  Show dependency tree
 
Reported: 2014-11-24 09:38 UTC by Agostino Sarubbo
Modified: 2014-12-26 01:20 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-11-24 09:38:09 UTC 
From ${URL} :

Unspecified vulnerability was fixed in flac upstream repository [1]

There're currently no publicly availble details about this issue:
The commit above will be included in flac 1.3.1, which will be out early next week [2].

[1]: https://git.xiph.org/?p=flac.git;a=patch;h=5b3033a2b355068c11fe637e14ac742d273f076e
[2]: http://lists.xiph.org/pipermail/flac-dev/2014-November/005185.html


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Tim Harder gentoo-dev 2014-11-27 13:48:33 UTC 
1.3.1 added to the tree. @security: Feel free to start the stabilization process if you like.
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2014-11-27 18:03:48 UTC 
Arches, please test and mark stable:

=media-libs/flac-1.3.1

Target Keywords : "alpha amd64 arm hppa ia64 ppc ppc64 spark x86"

Thank you!
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2014-11-27 18:12:24 UTC 
CVE-2014-8962 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8962):
  Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1
  allows remote attackers to execute arbitrary code via a crafted .flac file.
Comment 4 Jeroen Roovers (RETIRED) gentoo-dev 2014-11-28 21:49:25 UTC 
Arch teams, please test and mark stable:
=media-libs/flac-1.3.1-r1
Targeted stable KEYWORDS : alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
Comment 5 Jeroen Roovers (RETIRED) gentoo-dev 2014-11-29 19:41:07 UTC 
Stable for HPPA.
Comment 6 Agostino Sarubbo gentoo-dev 2014-12-01 09:18:36 UTC 
sparc stable
Comment 7 Markus Meier gentoo-dev 2014-12-02 20:46:09 UTC 
arm stable
Comment 8 Agostino Sarubbo gentoo-dev 2014-12-03 10:02:11 UTC 
ppc stable
Comment 9 Agostino Sarubbo gentoo-dev 2014-12-06 16:49:39 UTC 
ia64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2014-12-12 09:09:40 UTC 
amd64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2014-12-12 09:23:29 UTC 
x86 stable
Comment 12 Agostino Sarubbo gentoo-dev 2014-12-23 09:30:47 UTC 
alpha stable
Comment 13 Agostino Sarubbo gentoo-dev 2014-12-24 14:49:09 UTC 
ppc64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 14 Yury German Gentoo Infrastructure gentoo-dev 2014-12-24 21:06:35 UTC 
Arches and Maintainer(s), Thank you for your work.

New GLSA Request filed.
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2014-12-26 01:20:39 UTC 
This issue was resolved and addressed in
 GLSA 201412-40 at http://security.gentoo.org/glsa/glsa-201412-40.xml
by GLSA coordinator Sean Amoss (ackle).