Test ID:	1.3.6.1.4.1.25623.1.0.60743
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2008:0235
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory RHSA-2008:0235. Speex is a patent-free compression format designed especially for speech. The Speex package contains a library for handling Speex files and sample encoder and decoder implementations using this library. The Speex library was found to not properly validate input values read from the Speex files headers. An attacker could create a malicious Speex file that would crash an application or, possibly, allow arbitrary code execution with the privileges of the application calling the Speex library. (CVE-2008-1686) All users of speex are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2008-0235.html http://www.redhat.com/security/updates/classification/#important Risk factor : Critical CVSS Score: 9.3
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-1686 BugTraq ID: 28665 http://www.securityfocus.com/bid/28665 Bugtraq: 20080417 [oCERT-2008-004] multiple speex implementations insufficientboundary checks (Google Search) http://www.securityfocus.com/archive/1/491009/100/0/threaded Debian Security Information: DSA-1584 (Google Search) http://www.debian.org/security/2008/dsa-1584 Debian Security Information: DSA-1585 (Google Search) http://www.debian.org/security/2008/dsa-1585 Debian Security Information: DSA-1586 (Google Search) http://www.debian.org/security/2008/dsa-1586 https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00244.html https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00287.html https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00357.html http://security.gentoo.org/glsa/glsa-200804-17.xml http://www.mandriva.com/security/advisories?name=MDVSA-2008:092 http://www.mandriva.com/security/advisories?name=MDVSA-2008:093 http://www.mandriva.com/security/advisories?name=MDVSA-2008:094 http://www.mandriva.com/security/advisories?name=MDVSA-2008:124 http://www.ocert.org/advisories/ocert-2008-004.html http://www.ocert.org/advisories/ocert-2008-2.html http://lists.xiph.org/pipermail/speex-dev/2008-April/006636.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10026 http://www.redhat.com/support/errata/RHSA-2008-0235.html http://www.securitytracker.com/id?1019875 http://secunia.com/advisories/29672 http://secunia.com/advisories/29727 http://secunia.com/advisories/29835 http://secunia.com/advisories/29845 http://secunia.com/advisories/29854 http://secunia.com/advisories/29866 http://secunia.com/advisories/29878 http://secunia.com/advisories/29880 http://secunia.com/advisories/29881 http://secunia.com/advisories/29882 http://secunia.com/advisories/29898 http://secunia.com/advisories/30104 http://secunia.com/advisories/30117 http://secunia.com/advisories/30119 http://secunia.com/advisories/30337 http://secunia.com/advisories/30353 http://secunia.com/advisories/30358 http://secunia.com/advisories/30581 http://secunia.com/advisories/30717 http://secunia.com/advisories/31393 http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.460836 SuSE Security Announcement: SUSE-SR:2008:012 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html SuSE Security Announcement: SUSE-SR:2008:013 (Google Search) http://www.novell.com/linux/security/advisories/2008_13_sr.html http://www.ubuntu.com/usn/usn-611-1 http://www.ubuntu.com/usn/usn-611-2 http://www.ubuntu.com/usn/usn-611-3 http://www.ubuntu.com/usn/usn-635-1 http://www.vupen.com/english/advisories/2008/1187/references http://www.vupen.com/english/advisories/2008/1228/references http://www.vupen.com/english/advisories/2008/1268/references http://www.vupen.com/english/advisories/2008/1269/references http://www.vupen.com/english/advisories/2008/1300/references http://www.vupen.com/english/advisories/2008/1301/references http://www.vupen.com/english/advisories/2008/1302/references XForce ISS Database: fishsound-libfishsound-speex-bo(41684) https://exchange.xforce.ibmcloud.com/vulnerabilities/41684
Copyright	Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.