Bug 914441 (CVE-2014-9639)

Summary: VUL-0: CVE-2014-9639: vorbis-tools: Oggenc channel integer overflow
Product: [Novell Products] SUSE Security Incidents Reporter: Victor Pereira <vpereira>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: smash_bz, tiwai
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/113083/
Whiteboard: maint:running:62305:moderate CVSSv2:RedHat:CVE-2014-9639:2.1:(AV:L/AC:L/Au:N/C:N/I:N/A:P) CVSSv2:NVD:CVE-2014-9639:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Victor Pereira 2015-01-23 07:53:47 UTC
CVE-2014-9639

discovered an integer overflow issue in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash here (audio.c) :

576 memcpy(wav->channel_permute, wav_permute_matrix[wav->channels-1], 577 sizeof(int) * wav->channels);

Tests were performed using vorbis-tools 1.4.0


References:
https://trac.xiph.org/attachment/ticket/2136/crash_ex.wav (reproducer)
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9639
http://seclists.org/oss-sec/2015/q1/220
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9639.html
Comment 1 Swamp Workflow Management 2015-01-23 23:00:36 UTC
bugbot adjusting priority
Comment 2 Takashi Iwai 2015-02-04 16:56:29 UTC
The fix is found in
  https://bugzilla.novell.com/show_bug.cgi?id=914439#c3
Comment 3 Takashi Iwai 2015-03-06 14:47:23 UTC
The fix packages have been submitted as a fix for bnc#914439.
Comment 5 Bernhard Wiedemann 2015-03-06 15:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (914441) was mentioned in
https://build.opensuse.org/request/show/289678 13.2 / vorbis-tools
https://build.opensuse.org/request/show/289679 13.1 / vorbis-tools
Comment 6 Swamp Workflow Management 2015-03-18 15:05:11 UTC
openSUSE-SU-2015:0522-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 914439,914441
CVE References: CVE-2014-9638,CVE-2014-9639
Sources used:
openSUSE 13.2 (src):    vorbis-tools-1.4.0-17.8.1
openSUSE 13.1 (src):    vorbis-tools-1.4.0-14.16.1
Comment 7 Swamp Workflow Management 2015-06-09 08:06:09 UTC
SUSE-SU-2015:1014-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 914439,914441
CVE References: CVE-2014-9638,CVE-2014-9639
Sources used:
SUSE Linux Enterprise Server 12 (src):    vorbis-tools-1.4.0-23.1
SUSE Linux Enterprise Desktop 12 (src):    vorbis-tools-1.4.0-23.1
Comment 10 Swamp Workflow Management 2015-10-07 13:31:42 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-10-21.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62305
Comment 11 Swamp Workflow Management 2015-10-19 08:10:06 UTC
SUSE-SU-2015:1775-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 914439,914441,943795
CVE References: CVE-2014-9638,CVE-2014-9639,CVE-2015-6749
Sources used:
SUSE Linux Enterprise Desktop 11-SP4 (src):    vorbis-tools-1.1.1-174.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    vorbis-tools-1.1.1-174.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    vorbis-tools-1.1.1-174.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    vorbis-tools-1.1.1-174.1
Comment 12 Victor Pereira 2016-03-21 16:06:34 UTC
fixed and released.