USN-5409-1: libsndfile vulnerability
10 May 2022
libsndfile could be made to crash or expose sensitive information if it received specially crafted input.
Releases
Packages
- libsndfile - Library for reading/writing audio files
Details
It was discovered that libsndfile was incorrectly performing memory
management operations and incorrectly using buffers when executing
its FLAC codec. If a user or automated system were tricked into
processing a specially crafted sound file, an attacker could
possibly use this issue to cause a denial of service or obtain
sensitive information.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
libsndfile1
-
1.0.25-10ubuntu0.16.04.3+esm2
Available with Ubuntu Pro
-
libsndfile1-dev
-
1.0.25-10ubuntu0.16.04.3+esm2
Available with Ubuntu Pro
-
sndfile-programs
-
1.0.25-10ubuntu0.16.04.3+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.