Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 635430 (CVE-2017-9259, CVE-2017-9260) - <media-libs/libsoundtouch-2.0.0-r1: Multiple vulnerabilities
Summary: <media-libs/libsoundtouch-2.0.0-r1: Multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2017-9259, CVE-2017-9260
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-25 16:28 UTC by GLSAMaker/CVETool Bot
Modified: 2018-11-25 01:00 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2017-10-25 16:28:35 UTC 
CVE-2017-9260 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9260):
  The TDStretchSSE::calcCrossCorr function in
  source/SoundTouch/sse_optimized.cpp in SoundTouch 1.9.2 allows remote
  attackers to cause a denial of service (heap-based buffer over-read and
  application crash) via a crafted wav file.

CVE-2017-9259 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9259):
  The TDStretch::acceptNewOverlapLength function in
  source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers
  to cause a denial of service (memory allocation error and application crash)
  via a crafted wav file.

CVE-2017-9258 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9258):
  The TDStretch::processSamples function in source/SoundTouch/TDStretch.cpp in
  SoundTouch 1.9.2 allows remote attackers to cause a denial of service
  (infinite loop and CPU consumption) via a crafted wav file.
Comment 1 Andreas Sturmlechner gentoo-dev 2018-09-14 19:00:13 UTC 
sound is done here, anyway...