Advisories » MGASA-2017-0413

Updated libextractor packages fix security vulnerabilities

Publication date: 19 Nov 2017
Modification date: 19 Nov 2017
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2017-15266 , CVE-2017-15267

Description

In 'EXTRACTOR_wav_extract_method' function of wav_extractor.c, the
program does not check the value of sample_rate, with a crafted file,
the sample_rate can be set to zero, resulting in a divide by zero and a
crash (CVE-2017-15266).

NULL Pointer Dereference vulneribility in libextract when getting flac
meta from libFlac (CVE-2017-15267).

NULL Pointer Dereference vulneribility in libextractor
EXTRACTOR_nsf_extract_method() (rhbz#1501695).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=21856
• http://openwall.com/lists/oss-security/2017/10/12/15
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Z3JVQF4TREMGJ5RI6JHPIZ6STU3H572K/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15266
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15267

SRPMS

6/core

• libextractor-1.6-1.mga6

5/core

• libextractor-1.6-1.mga5