Test ID:	1.3.6.1.4.1.25623.1.1.10.2017.0168
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2017-0168)
Summary:	The remote host is missing an update for the 'libsndfile' package(s) announced via the MGASA-2017-0168 advisory.
Description:	Summary: The remote host is missing an update for the 'libsndfile' package(s) announced via the MGASA-2017-0168 advisory. Vulnerability Insight: A stack-based buffer overflow via a specially crafted FLAC file due to an error in the header_read() function (CVE-2017-7586). Several stack-based buffer overflows via a specially crafted FLAC file due to an error in the flac_buffer_copy() function (CVE-2017-7585, CVE-2017-7741, CVE-2017-7742). Global buffer overflow in flac_buffer_copy() (CVE-2017-8361). Invalid memory read in flac_buffer_copy() (CVE-2017-8362). Heap-based buffer overflow in flac_buffer_copy() (CVE-2017-8363). The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file (CVE-2017-8365). Affected Software/OS: 'libsndfile' package(s) on Mageia 5. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-7585 https://security.gentoo.org/glsa/201707-04 https://secuniaresearch.flexerasoftware.com/secunia_research/2017-4/ Common Vulnerability Exposure (CVE) ID: CVE-2017-7586 BugTraq ID: 97522 http://www.securityfocus.com/bid/97522 Common Vulnerability Exposure (CVE) ID: CVE-2017-7741 https://blogs.gentoo.org/ago/2017/04/11/libsndfile-invalid-memory-read-and-invalid-memory-write-in/ https://github.com/erikd/libsndfile/commit/60b234301adf258786d8b90be5c1d437fc8799e0 Common Vulnerability Exposure (CVE) ID: CVE-2017-7742 Common Vulnerability Exposure (CVE) ID: CVE-2017-8361 https://security.gentoo.org/glsa/201811-23 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/ https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html Common Vulnerability Exposure (CVE) ID: CVE-2017-8362 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/ Common Vulnerability Exposure (CVE) ID: CVE-2017-8363 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/ Common Vulnerability Exposure (CVE) ID: CVE-2017-8365 https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.