UbuntuUpdates.org

Package "sox"

Name: sox

Description:

Swiss army knife of sound processing
Latest version: 14.4.1-3ubuntu1.1
Release: trusty (14.04)
Level: security
Repository: universe
Homepage: http://sox.sourceforge.net

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "sox"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "sox" in Trusty

Repository Area Version
base universe 14.4.1-3ubuntu1
updates universe 14.4.1-3ubuntu1.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 14.4.1-3ubuntu1.1 2019-01-31 23:06:59 UTC

  sox (14.4.1-3ubuntu1.1) trusty-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow
    - debian/patches/0001-Check-for-minimum-size-sphere-headers.patch: Avoid
      integer underflow by validating the header_size_ul for NIST sphere
      formatted media files.
    - debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch: Check
      the number of samples in a wav block against the expected samples per
      block.
    - CVE-2014-8145
  * SECURITY UPDATE: Division by zero
    - debian/patches/CVE-2017-11332.patch: wav: fix crash if channel count is
      zero
    - CVE-2017-11332
  * SECURITY UPDATE: Division by zero
    - debian/patches/CVE-2017-11358.patch: hcom: fix crash on input with
      corrupt dictionary
    - CVE-2017-11358
  * SECURITY UPDATE: Invalid memory read
    - debian/patches/CVE-2017-11359.patch: wav: fix crash writing header when
      channel count >64k
    - CVE-2017-11359
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2017-15370.patch: wav: ima_adpcm: fix buffer overflow
      on corrupt input
    - CVE-2017-15370
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2017-15371.patch: flac: fix crash on corrupt metadata
    - CVE-2017-15371
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2017-15372.patch: adpcm: fix stack overflow with >4
      channels
    - CVE-2017-15372
  * SECURITY UPDATE: Use after free
    - debian/patches/CVE-2017-15642.patch: adpcm: fix a user after free and
      double free if an empty comment chunk follows a non-empty one.
    - CVE-2017-15642
  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2017-18189.patch: Prevent infinite loop caused by
        specifying zero channels in a header. Also add an upper bound to prevent
        overflow in multiplication
    - CVE-2017-18189

 -- Mike Salvatore <email address hidden> Thu, 31 Jan 2019 11:22:54 -0500
CVE-2014-8145 Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV f
CVE-2017-11332 The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and applica
CVE-2017-11358 The read_samples function in hcom.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (invalid memory read and appl
CVE-2017-11359 The wavwritehdr function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and appli
CVE-2017-15370 There is a heap-based buffer overflow in the ImaExpandS function of ima_rw.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of
CVE-2017-15371 There is a reachable assertion abort in the function sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a
CVE-2017-15372 There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 14.4.2. A Crafted input will le
CVE-2017-15642 In lsx_aiffstartread in aiff.c in Sound eXchange (SoX) 14.4.2, there is a Use-After-Free vulnerability triggered by supplying a malformed AIFF file.
CVE-2017-18189 In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a


About   -   Send Feedback to @ubuntu_updates