Bug 9916

Summary:	libsndfile security vulnerability (CVE-2018-19758)
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Zombie Ryushu <zombie.ryushu>
Component:	Preinstalled software in the ISO	Assignee:	ROSA Linux Bugs <bugs>
Status:	RESOLVED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	alzim, andrey.bondrov, denis.silakov, mc2374
Version:	All
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	https://advisories.mageia.org/MGASA-2019-0182.html
Whiteboard:
Platform:	2016.1	ROSA Vulnerability identifier:	CVE-2018-19758 CVE-2019-3832
RPM Package:	libsndfile-1.0.28-3.src.rpm	ISO-related:
Bad POT generating:		Upstream:
Bug Depends on:	9929
Bug Blocks:

Description Zombie Ryushu 2019-05-20 01:47:45 MSK

A heap-based buffer over-read at wav.c in wav_write_header that could be
used for a denial of service attack (CVE-2018-19758).

Comment 1 Giovanni Mariani 2019-05-27 12:56:51 MSK

Really the solution for the CVE referenced here is not complete: there is also
CVE-2019-3832 that need to be fixed...
See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3832

Taking...

Comment 2 Giovanni Mariani 2019-05-29 20:41:53 MSK

QA says we already have the fixed package...
Closing: please reopen if not true.