Package: release.debian.org Severity: normal Tags: jessie User: release.debian....@packages.debian.org Usertags: pu
Hi, lame 3.99.5+repack1-7+deb8u1 is affected by several vulnerabilities in the code used to read the input file. These issues are not present in any Debian release after Jessie because the package switched to libsndfile to read and write audio files. The upstream code itself was recently fixed in 3.100. Following advices from lame's upstream and from lame's maintainer I proposed the attached patch. In this patch we modify the Jessie package to use libsndfile instead of the internal code. The security team considers these issues not worth a DSA but recommended me to submit this patch as jessie-pu. You can find more detailed information about this patch on the debian-lts ML[0]. Thanks ! Regards, Hugo [0] https://lists.debian.org/debian-lts/2018/05/msg00081.html -- Hugo Lefeuvre (hle) | www.owl.eu.com 4096/ 9C4F C8BF A4B0 8FC5 48EB 56B8 1962 765B B9A8 BACA
diff -Nru lame-3.99.5+repack1/debian/changelog lame-3.99.5+repack1/debian/changelog --- lame-3.99.5+repack1/debian/changelog 2015-06-15 09:05:28.000000000 -0400 +++ lame-3.99.5+repack1/debian/changelog 2018-05-27 17:30:02.000000000 -0400 @@ -1,3 +1,16 @@ +lame (3.99.5+repack1-7+deb8u2) oldstable; urgency=high + + [ Fabian Greffrath ] + + * Build the frontend with the sndfile io routines, RAW PCM and WAV can be + read from stdin since at least 3.99.0 (Closes: #867725). + - Add Build-Depends: libsndfile1-dev. + + Addressed CVEs: CVE-2017-9872, CVE-2017-9871, CVE-2017-9870, CVE-2017-9869, + CVE-2017-15046, CVE-2017-15045, CVE-2017-15018. + + -- Hugo Lefeuvre <h...@debian.org> Sun, 27 May 2018 17:30:02 -0400 + lame (3.99.5+repack1-7+deb8u1) jessie; urgency=medium * debian/patches/force_align_arg_pointer.patch: Enable functions with SSE diff -Nru lame-3.99.5+repack1/debian/control lame-3.99.5+repack1/debian/control --- lame-3.99.5+repack1/debian/control 2015-06-15 09:03:04.000000000 -0400 +++ lame-3.99.5+repack1/debian/control 2018-05-27 17:16:42.000000000 -0400 @@ -9,6 +9,7 @@ debhelper (>= 9), dh-autoreconf, libncurses5-dev, + libsndfile1-dev, pkg-config, nasm [i386] Standards-Version: 3.9.5 diff -Nru lame-3.99.5+repack1/debian/rules lame-3.99.5+repack1/debian/rules --- lame-3.99.5+repack1/debian/rules 2015-06-15 09:03:04.000000000 -0400 +++ lame-3.99.5+repack1/debian/rules 2018-05-27 17:16:42.000000000 -0400 @@ -9,4 +9,4 @@ --enable-dynamic-frontends \ --enable-expopt=full \ --enable-nasm \ - --with-fileio=lame + --with-fileio=sndfile
signature.asc
Description: PGP signature