Bug 914441 - (CVE-2014-9639) VUL-0: CVE-2014-9639: vorbis-tools: Oggenc channel integer overflow
(CVE-2014-9639)
VUL-0: CVE-2014-9639: vorbis-tools: Oggenc channel integer overflow
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/113083/
maint:running:62305:moderate CVSSv2:R...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-01-23 07:53 UTC by Victor Pereira
Modified: 2016-04-27 19:34 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2015-01-23 07:53:47 UTC
CVE-2014-9639

discovered an integer overflow issue in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash here (audio.c) :

576 memcpy(wav->channel_permute, wav_permute_matrix[wav->channels-1], 577 sizeof(int) * wav->channels);

Tests were performed using vorbis-tools 1.4.0


References:
https://trac.xiph.org/attachment/ticket/2136/crash_ex.wav (reproducer)
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9639
http://seclists.org/oss-sec/2015/q1/220
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9639.html
Comment 1 Swamp Workflow Management 2015-01-23 23:00:36 UTC
bugbot adjusting priority
Comment 2 Takashi Iwai 2015-02-04 16:56:29 UTC
The fix is found in
  https://bugzilla.novell.com/show_bug.cgi?id=914439#c3
Comment 3 Takashi Iwai 2015-03-06 14:47:23 UTC
The fix packages have been submitted as a fix for bnc#914439.
Comment 5 Bernhard Wiedemann 2015-03-06 15:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (914441) was mentioned in
https://build.opensuse.org/request/show/289678 13.2 / vorbis-tools
https://build.opensuse.org/request/show/289679 13.1 / vorbis-tools
Comment 6 Swamp Workflow Management 2015-03-18 15:05:11 UTC
openSUSE-SU-2015:0522-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 914439,914441
CVE References: CVE-2014-9638,CVE-2014-9639
Sources used:
openSUSE 13.2 (src):    vorbis-tools-1.4.0-17.8.1
openSUSE 13.1 (src):    vorbis-tools-1.4.0-14.16.1
Comment 7 Swamp Workflow Management 2015-06-09 08:06:09 UTC
SUSE-SU-2015:1014-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 914439,914441
CVE References: CVE-2014-9638,CVE-2014-9639
Sources used:
SUSE Linux Enterprise Server 12 (src):    vorbis-tools-1.4.0-23.1
SUSE Linux Enterprise Desktop 12 (src):    vorbis-tools-1.4.0-23.1
Comment 10 Swamp Workflow Management 2015-10-07 13:31:42 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-10-21.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62305
Comment 11 Swamp Workflow Management 2015-10-19 08:10:06 UTC
SUSE-SU-2015:1775-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 914439,914441,943795
CVE References: CVE-2014-9638,CVE-2014-9639,CVE-2015-6749
Sources used:
SUSE Linux Enterprise Desktop 11-SP4 (src):    vorbis-tools-1.1.1-174.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    vorbis-tools-1.1.1-174.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    vorbis-tools-1.1.1-174.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    vorbis-tools-1.1.1-174.1
Comment 12 Victor Pereira 2016-03-21 16:06:34 UTC
fixed and released.