CVE-2017-14634 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14634): In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file. References: https://github.com/erikd/libsndfile/issues/318
@maintainer(s), fixed version already in tree, please confirm if stable, thank you. Daj Uan (jmbailey) Gentoo Security Padawan
The current ebuild in the tree, 1.0.28-r1, still contains this bug. Currently patches are available, however no official release contains the fixes.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b8fc21b710b18e21dfba9506f666ec18744a3e64 commit b8fc21b710b18e21dfba9506f666ec18744a3e64 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2018-10-03 19:16:17 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2018-10-03 19:22:05 +0000 media-libs/libsndfile: Fix multiple vulnerabilities Bug: https://bugs.gentoo.org/618016 Bug: https://bugs.gentoo.org/631634 Bug: https://bugs.gentoo.org/624814 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> Package-Manager: Portage-2.3.50, Repoman-2.3.11 .../files/libsndfile-1.0.28-CVE-2017-14634.patch | 35 +++++++++++ .../files/libsndfile-1.0.28-CVE-2017-6892.patch | 25 ++++++++ .../files/libsndfile-1.0.28-CVE-2017-8362.patch | 50 ++++++++++++++++ .../files/libsndfile-1.0.28-CVE-2017-8363.patch | 28 +++++++++ .../files/libsndfile-1.0.28-CVE-2017-8365.patch | 64 ++++++++++++++++++++ .../files/libsndfile-1.0.28-CVE-2018-13139.patch | 2 +- media-libs/libsndfile/libsndfile-1.0.28-r4.ebuild | 70 ++++++++++++++++++++++ 7 files changed, 273 insertions(+), 1 deletion(-)
This issue was resolved and addressed in GLSA 201811-23 at https://security.gentoo.org/glsa/201811-23 by GLSA coordinator Aaron Bauman (b-man).