Bastien Roucariès pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
55f0616d by Bastien Roucariès at 2023-08-13T12:50:48+00:00
CVE-2023-34318: fixed by same fix as CVE-2021-23159
Tested poc under trixie and gdb tracing.
Fail early (before the location of leak) by:
Implausible dictionary size in HCOM header
Cross tested also under valgrind
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4913,10 +4913,12 @@ CVE-2023-34432 (A heap buffer overflow vulnerability
was found in sox, in the ls
CVE-2023-34347 (Delta Electronics InfraSuite Device Master versions prior to
1.0.7 con ...)
NOT-FOR-US: Delta Electronics InfraSuite Device Master
CVE-2023-34318 (A heap buffer overflow vulnerability was found in sox, in the
startrea ...)
- - sox <unfixed> (bug #1041111)
+ - sox 14.4.2+git20190427-3.2 (bug #1041111)
+ [bullseye] - sox 14.4.2+git20190427-2+deb11u1
+ [buster] - sox 14.4.2+git20190427-1+deb10u1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2212283
NOTE: https://sourceforge.net/p/sox/bugs/368/
- TODO: check, might be fixed along with the fix for CVE-2021-23159
+ NOTE: Same fix as for CVE-2021-23159
CVE-2023-34316 (An attacker could bypass the latest Delta Electronics
InfraSuite Devic ...)
NOT-FOR-US: Delta Electronics InfraSuite Device Master
CVE-2023-32627 (A floating point exception vulnerability was found in sox, in
the read ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55f0616d8f1b2e3f83bc218676943dc1a65b2d34
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55f0616d8f1b2e3f83bc218676943dc1a65b2d34
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
