Security update for lame SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:0544-1 Final 1 1 2018-02-26T07:35:52Z current 2018-02-26T07:35:52Z 2018-02-26T07:35:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for lame This update for lame fixes the following issues: Lame was updated to version 3.100: * Improved detection of MPEG audio data in RIFF WAVE files. sf#3545112 Invalid sampling detection * New switch --gain <decibel>, range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the use of --scale <factor>. * Fix for sf#3558466 Bug in path handling * Fix for sf#3567844 problem with Tag genre * Fix for sf#3565659 no progress indication with pipe input * Fix for sf#3544957 scale (empty) silent encode without warning * Fix for sf#3580176 environment variable LAMEOPT doesn't work anymore * Fix for sf#3608583 input file name displayed with wrong character encoding (on windows console with CP_UTF8) * Fix dereference NULL and Buffer not NULL terminated issues. (CVE-2017-15019 bsc#1082317 CVE-2017-13712 bsc#1082399 CVE-2015-9100 bsc#1082401) * Fix dereference of a null pointer possible in loop. * Make sure functions with SSE instructions maintain their own properly aligned stack. Thanks to Fabian Greffrath * Multiple Stack and Heap Corruptions from Malicious File. (CVE-2017-9872 bsc#1082391 CVE-2017-9871 bsc#1082392 CVE-2017-9870 bsc#1082393 CVE-2017-9869 bsc#1082395 CVE-2017-9411 bsc#1082397 CVE-2015-9101 bsc#1082400) * CVE-2017-11720: Fix a division by zero vulnerability. (bsc#1082311) * CVE-2017-9410: Fix fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap (bsc#1082333) * CVE-2017-9411: Fix fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash (bsc#1082397) * CVE-2017-9412: FIx unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash (bsc#1082340) * Fix clip detect scale suggestion unaware of scale input value * HIP decoder bug fixed: decoding mixed blocks of lower sample frequency Layer3 data resulted in internal buffer overflow. * Add lame_encode_buffer_interleaved_int() The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2018-214 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG E-Mail link for openSUSE-SU-2018:0544-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1082311 SUSE Bug 1082311 https://bugzilla.suse.com/1082317 SUSE Bug 1082317 https://bugzilla.suse.com/1082333 SUSE Bug 1082333 https://bugzilla.suse.com/1082340 SUSE Bug 1082340 https://bugzilla.suse.com/1082391 SUSE Bug 1082391 https://bugzilla.suse.com/1082392 SUSE Bug 1082392 https://bugzilla.suse.com/1082393 SUSE Bug 1082393 https://bugzilla.suse.com/1082395 SUSE Bug 1082395 https://bugzilla.suse.com/1082397 SUSE Bug 1082397 https://bugzilla.suse.com/1082399 SUSE Bug 1082399 https://bugzilla.suse.com/1082400 SUSE Bug 1082400 https://bugzilla.suse.com/1082401 SUSE Bug 1082401 https://www.suse.com/security/cve/CVE-2015-9100/ SUSE CVE CVE-2015-9100 page https://www.suse.com/security/cve/CVE-2015-9101/ SUSE CVE CVE-2015-9101 page https://www.suse.com/security/cve/CVE-2017-11720/ SUSE CVE CVE-2017-11720 page https://www.suse.com/security/cve/CVE-2017-13712/ SUSE CVE CVE-2017-13712 page https://www.suse.com/security/cve/CVE-2017-15019/ SUSE CVE CVE-2017-15019 page https://www.suse.com/security/cve/CVE-2017-9410/ SUSE CVE CVE-2017-9410 page https://www.suse.com/security/cve/CVE-2017-9411/ SUSE CVE CVE-2017-9411 page https://www.suse.com/security/cve/CVE-2017-9412/ SUSE CVE CVE-2017-9412 page https://www.suse.com/security/cve/CVE-2017-9869/ SUSE CVE CVE-2017-9869 page https://www.suse.com/security/cve/CVE-2017-9870/ SUSE CVE CVE-2017-9870 page https://www.suse.com/security/cve/CVE-2017-9871/ SUSE CVE CVE-2017-9871 page https://www.suse.com/security/cve/CVE-2017-9872/ SUSE CVE CVE-2017-9872 page SUSE Package Hub 12 SP2 lame-3.100-6.1 lame-doc-3.100-6.1 lame-mp3rtp-3.100-6.1 libmp3lame-devel-3.100-6.1 libmp3lame0-3.100-6.1 lame-3.100-6.1 as a component of SUSE Package Hub 12 SP2 lame-doc-3.100-6.1 as a component of SUSE Package Hub 12 SP2 lame-mp3rtp-3.100-6.1 as a component of SUSE Package Hub 12 SP2 libmp3lame-devel-3.100-6.1 as a component of SUSE Package Hub 12 SP2 libmp3lame0-3.100-6.1 as a component of SUSE Package Hub 12 SP2 The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file. CVE-2015-9100 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2015-9100.html CVE-2015-9100 https://bugzilla.suse.com/1082401 SUSE Bug 1082401 The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4 and 3.99.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file. CVE-2015-9101 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2015-9101.html CVE-2015-9101 https://bugzilla.suse.com/1082400 SUSE Bug 1082400 There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file. CVE-2017-11720 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-11720.html CVE-2017-11720 https://bugzilla.suse.com/1082311 SUSE Bug 1082311 https://bugzilla.suse.com/1082397 SUSE Bug 1082397 NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument. CVE-2017-13712 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-13712.html CVE-2017-13712 https://bugzilla.suse.com/1082399 SUSE Bug 1082399 LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call. CVE-2017-15019 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-15019.html CVE-2017-15019 https://bugzilla.suse.com/1082317 SUSE Bug 1082317 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-9101. Reason: This candidate is a duplicate of CVE-2015-9101. Notes: All CVE users should reference CVE-2015-9101 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. CVE-2017-9410 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-9410.html CVE-2017-9410 https://bugzilla.suse.com/1061970 SUSE Bug 1061970 https://bugzilla.suse.com/1082333 SUSE Bug 1082333 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-9100. Reason: This candidate is a duplicate of CVE-2015-9100. Notes: All CVE users should reference CVE-2015-9100 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. CVE-2017-9411 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-9411.html CVE-2017-9411 https://bugzilla.suse.com/1082397 SUSE Bug 1082397 The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file. CVE-2017-9412 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-9412.html CVE-2017-9412 https://bugzilla.suse.com/1061973 SUSE Bug 1061973 https://bugzilla.suse.com/1082340 SUSE Bug 1082340 The II_step_one function in layer2.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file. CVE-2017-9869 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-9869.html CVE-2017-9869 https://bugzilla.suse.com/1082395 SUSE Bug 1082395 The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type == 2" case, a similar issue to CVE-2017-11126. CVE-2017-9870 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-9870.html CVE-2017-9870 https://bugzilla.suse.com/1046766 SUSE Bug 1046766 https://bugzilla.suse.com/1082393 SUSE Bug 1082393 The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file. CVE-2017-9871 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-9871.html CVE-2017-9871 https://bugzilla.suse.com/1082392 SUSE Bug 1082392 The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file. CVE-2017-9872 SUSE Package Hub 12 SP2:lame-3.100-6.1 SUSE Package Hub 12 SP2:lame-doc-3.100-6.1 SUSE Package Hub 12 SP2:lame-mp3rtp-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame-devel-3.100-6.1 SUSE Package Hub 12 SP2:libmp3lame0-3.100-6.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KH623JZ3J2KZAJL44XIFV3PAHON2NVKG/#KH623JZ3J2KZAJL44XIFV3PAHON2NVKG https://www.suse.com/security/cve/CVE-2017-9872.html CVE-2017-9872 https://bugzilla.suse.com/1082391 SUSE Bug 1082391 https://bugzilla.suse.com/1092153 SUSE Bug 1092153 https://bugzilla.suse.com/1199458 SUSE Bug 1199458