Hi.
There is a security bug in package 'libsndfile'.

This bug is public.

There is no coordinated release date (CRD) set.

CVE number: CVE-2009-4835
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4835

Original posting:


----------  Weitergeleitete Nachricht  ----------

Betreff: [Full-disclosure] [ MDVSA-2010:150 ] libsndfile
Datum: Samstag, 14. August 2010, 19:28:01
Von: security@mandriva.com
An:  full-disclosure@lists.grok.org.uk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:150
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libsndfile
 Date    : August 14, 2010
 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0,
           Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been discovered and corrected in libsndfile:
 
 The (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init,
 (5) float32_init, and (6) sds_read_header functions in libsndfile
 1.0.20 allow context-dependent attackers to cause a denial of service
 (divide-by-zero error and application crash) via a crafted audio file
 (CVE-2009-4835).
 
 Packages for 2008.0 and 2009.0 are provided as of the Extended
 Maintenance Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4835
 _______________________________________________________________________
..