Test ID:	1.3.6.1.4.1.25623.1.0.851711
Category:	SuSE Local Security Checks
Title:	openSUSE: Security Advisory for lame (openSUSE-SU-2018:0544-1)
Summary:	The remote host is missing an update for the 'lame'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'lame' package(s) announced via the referenced advisory. Vulnerability Insight: This update for lame fixes the following issues: Lame was updated to version 3.100: * Improved detection of MPEG audio data in RIFF WAVE files. sf#3545112 Invalid sampling detection * New switch --gain decibel, range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the use of --scale factor. * Fix for sf#3558466 Bug in path handling * Fix for sf#3567844 problem with Tag genre * Fix for sf#3565659 no progress indication with pipe input * Fix for sf#3544957 scale (empty) silent encode without warning * Fix for sf#3580176 environment variable LAMEOPT doesn't work anymore * Fix for sf#3608583 input file name displayed with wrong character encoding (on windows console with CP_UTF8) * Fix dereference NULL and Buffer not NULL terminated issues. (CVE-2017-15019 bsc#1082317 CVE-2017-13712 bsc#1082399 CVE-2015-9100 bsc#1082401) * Fix dereference of a null pointer possible in loop. * Make sure functions with SSE instructions maintain their own properly aligned stack. Thanks to Fabian Greffrath * Multiple Stack and Heap Corruptions from Malicious File. (CVE-2017-9872 bsc#1082391 CVE-2017-9871 bsc#1082392 CVE-2017-9870 bsc#1082393 CVE-2017-9869 bsc#1082395 CVE-2017-9411 bsc#1082397 CVE-2015-9101 bsc#1082400) * CVE-2017-11720: Fix a division by zero vulnerability. (bsc#1082311) * CVE-2017-9410: Fix fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap (bsc#1082333) * CVE-2017-9411: Fix fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash (bsc#1082397) * CVE-2017-9412: FIx unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash (bsc#1082340) * Fix clip detect scale suggestion unaware of scale input value * HIP decoder bug fixed: decoding mixed blocks of lower sample frequency Layer3 data resulted in internal buffer overflow. * Add lame_encode_buffer_interleaved_int() Affected Software/OS: lame on openSUSE Leap 42.3 Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-9100 BugTraq ID: 99278 http://www.securityfocus.com/bid/99278 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777160 Common Vulnerability Exposure (CVE) ID: CVE-2015-9101 BugTraq ID: 99269 http://www.securityfocus.com/bid/99269 https://blogs.gentoo.org/ago/2017/06/17/lame-heap-based-buffer-overflow-in-fill_buffer_resample-util-c/ https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777161 https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2015-9101 Common Vulnerability Exposure (CVE) ID: CVE-2017-11720 https://blogs.gentoo.org/ago/2017/06/17/lame-divide-by-zero-in-parse_wave_header-get_audio-c/ https://bugs.debian.org/777159 https://sourceforge.net/p/lame/bugs/460/ Common Vulnerability Exposure (CVE) ID: CVE-2017-13712 BugTraq ID: 100525 http://www.securityfocus.com/bid/100525 https://sourceforge.net/p/lame/bugs/472/ Common Vulnerability Exposure (CVE) ID: CVE-2017-15019 https://sourceforge.net/p/lame/bugs/477/ Common Vulnerability Exposure (CVE) ID: CVE-2017-9410 Common Vulnerability Exposure (CVE) ID: CVE-2017-9411 Common Vulnerability Exposure (CVE) ID: CVE-2017-9412 https://www.exploit-db.com/exploits/42390/ http://seclists.org/fulldisclosure/2017/Jul/63 Common Vulnerability Exposure (CVE) ID: CVE-2017-9869 BugTraq ID: 99272 http://www.securityfocus.com/bid/99272 https://www.exploit-db.com/exploits/42258/ https://blogs.gentoo.org/ago/2017/06/17/lame-global-buffer-overflow-in-ii_step_one-layer2-c/ Common Vulnerability Exposure (CVE) ID: CVE-2017-9870 BugTraq ID: 99287 http://www.securityfocus.com/bid/99287 https://blogs.gentoo.org/ago/2017/06/17/lame-global-buffer-overflow-in-iii_i_stereo-layer3-c/ Common Vulnerability Exposure (CVE) ID: CVE-2017-9871 BugTraq ID: 99289 http://www.securityfocus.com/bid/99289 https://blogs.gentoo.org/ago/2017/06/17/lame-stack-based-buffer-overflow-in-iii_i_stereo-layer3-c/ Common Vulnerability Exposure (CVE) ID: CVE-2017-9872 BugTraq ID: 99270 http://www.securityfocus.com/bid/99270 https://www.exploit-db.com/exploits/42259/ https://blogs.gentoo.org/ago/2017/06/17/lame-stack-based-buffer-overflow-in-iii_dequantize_sample-layer3-c/
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.