Security update for audiofile

Announcement ID:	SUSE-SU-2017:0940-1
Rating:	low
References:	bsc#1026978 bsc#1026979 bsc#1026980 bsc#1026981 bsc#1026982 bsc#1026983 bsc#1026984 bsc#1026985 bsc#1026986 bsc#1026987 bsc#1026988 bsc#949399
Cross-References:	CVE-2015-7747 CVE-2017-6827 CVE-2017-6828 CVE-2017-6829 CVE-2017-6830 CVE-2017-6831 CVE-2017-6832 CVE-2017-6833 CVE-2017-6834 CVE-2017-6835 CVE-2017-6836 CVE-2017-6837 CVE-2017-6838 CVE-2017-6839
CVSS scores:	CVE-2015-7747 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2017-6827 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2017-6828 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2017-6829 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6830 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6831 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6832 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6832 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6833 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6834 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-6834 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6834 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6835 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6836 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6836 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6837 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6838 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6839 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 SUSE Linux Enterprise Software Development Kit 12 12-SP2 SUSE Linux Enterprise Software Development Kit 12 SP1

An update that solves 14 vulnerabilities can now be installed.

Description:

This audiofile update fixes the following issue:

Security issues fixed: - CVE-2015-7747: Fixed buffer overflow issue when changing both number of channels and sample format. (bsc#949399) - CVE-2017-6827: heap-based buffer overflow in MSADPCM::initializeCoefficients (MSADPCM.cpp) (bsc#1026979) - CVE-2017-6828: heap-based buffer overflow in readValue (FileHandle.cpp) (bsc#1026980) - CVE-2017-6829: global buffer overflow in decodeSample (IMA.cpp) (bsc#1026981) - CVE-2017-6830: heap-based buffer overflow in alaw2linear_buf (G711.cpp) (bsc#1026982) - CVE-2017-6831: heap-based buffer overflow in IMA::decodeBlockWAVE (IMA.cpp) (bsc#1026983) - CVE-2017-6832: heap-based buffer overflow in MSADPCM::decodeBlock (MSADPCM.cpp) (bsc#1026984) - CVE-2017-6833: divide-by-zero in BlockCodec::runPull (BlockCodec.cpp) (bsc#1026985) - CVE-2017-6834: heap-based buffer overflow in ulaw2linear_buf (G711.cpp) (bsc#1026986) - CVE-2017-6835: divide-by-zero in BlockCodec::reset1 (BlockCodec.cpp) (bsc#1026988) - CVE-2017-6836: heap-based buffer overflow in Expand3To4Module::run (SimpleModule.h) (bsc#1026987) - CVE-2017-6837, CVE-2017-6838, CVE-2017-6839: multiple ubsan crashes (bsc#1026978)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP1
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-542=1
• SUSE Linux Enterprise Desktop 12 SP2
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-542=1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2
  zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-542=1
• SUSE Linux Enterprise Software Development Kit 12 SP1
  zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-542=1
• SUSE Linux Enterprise Software Development Kit 12 12-SP2
  zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-542=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-542=1
• SUSE Linux Enterprise Server 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-542=1
• SUSE Linux Enterprise High Performance Computing 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-542=1
• SUSE Linux Enterprise Server 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-542=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-542=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP1 (x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • libaudiofile1-0.3.6-10.1
  • libaudiofile1-debuginfo-0.3.6-10.1
  • libaudiofile1-debuginfo-32bit-0.3.6-10.1
  • libaudiofile1-32bit-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-0.3.6-10.1
• SUSE Linux Enterprise Desktop 12 SP2 (x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • libaudiofile1-0.3.6-10.1
  • libaudiofile1-debuginfo-0.3.6-10.1
  • libaudiofile1-debuginfo-32bit-0.3.6-10.1
  • libaudiofile1-32bit-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-0.3.6-10.1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 (aarch64)
  • audiofile-debugsource-0.3.6-10.1
  • libaudiofile1-0.3.6-10.1
  • libaudiofile1-debuginfo-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-0.3.6-10.1
• SUSE Linux Enterprise Software Development Kit 12 SP1 (ppc64le s390x x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-devel-0.3.6-10.1
• SUSE Linux Enterprise Software Development Kit 12 12-SP2 (aarch64 ppc64le s390x x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-devel-0.3.6-10.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (ppc64le x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • libaudiofile1-0.3.6-10.1
  • libaudiofile1-debuginfo-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-0.3.6-10.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (x86_64)
  • libaudiofile1-debuginfo-32bit-0.3.6-10.1
  • libaudiofile1-32bit-0.3.6-10.1
• SUSE Linux Enterprise Server 12 SP1 (ppc64le s390x x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • libaudiofile1-0.3.6-10.1
  • libaudiofile1-debuginfo-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-0.3.6-10.1
• SUSE Linux Enterprise Server 12 SP1 (s390x x86_64)
  • libaudiofile1-debuginfo-32bit-0.3.6-10.1
  • libaudiofile1-32bit-0.3.6-10.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (aarch64 x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • libaudiofile1-0.3.6-10.1
  • libaudiofile1-debuginfo-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-0.3.6-10.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (x86_64)
  • libaudiofile1-debuginfo-32bit-0.3.6-10.1
  • libaudiofile1-32bit-0.3.6-10.1
• SUSE Linux Enterprise Server 12 SP2 (aarch64 ppc64le s390x x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • libaudiofile1-0.3.6-10.1
  • libaudiofile1-debuginfo-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-0.3.6-10.1
• SUSE Linux Enterprise Server 12 SP2 (s390x x86_64)
  • libaudiofile1-debuginfo-32bit-0.3.6-10.1
  • libaudiofile1-32bit-0.3.6-10.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
  • audiofile-debugsource-0.3.6-10.1
  • libaudiofile1-0.3.6-10.1
  • libaudiofile1-debuginfo-0.3.6-10.1
  • audiofile-debuginfo-0.3.6-10.1
  • audiofile-0.3.6-10.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (x86_64)
  • libaudiofile1-debuginfo-32bit-0.3.6-10.1
  • libaudiofile1-32bit-0.3.6-10.1

References:

• https://www.suse.com/security/cve/CVE-2015-7747.html
• https://www.suse.com/security/cve/CVE-2017-6827.html
• https://www.suse.com/security/cve/CVE-2017-6828.html
• https://www.suse.com/security/cve/CVE-2017-6829.html
• https://www.suse.com/security/cve/CVE-2017-6830.html
• https://www.suse.com/security/cve/CVE-2017-6831.html
• https://www.suse.com/security/cve/CVE-2017-6832.html
• https://www.suse.com/security/cve/CVE-2017-6833.html
• https://www.suse.com/security/cve/CVE-2017-6834.html
• https://www.suse.com/security/cve/CVE-2017-6835.html
• https://www.suse.com/security/cve/CVE-2017-6836.html
• https://www.suse.com/security/cve/CVE-2017-6837.html
• https://www.suse.com/security/cve/CVE-2017-6838.html
• https://www.suse.com/security/cve/CVE-2017-6839.html
• https://bugzilla.suse.com/show_bug.cgi?id=1026978
• https://bugzilla.suse.com/show_bug.cgi?id=1026979
• https://bugzilla.suse.com/show_bug.cgi?id=1026980
• https://bugzilla.suse.com/show_bug.cgi?id=1026981
• https://bugzilla.suse.com/show_bug.cgi?id=1026982
• https://bugzilla.suse.com/show_bug.cgi?id=1026983
• https://bugzilla.suse.com/show_bug.cgi?id=1026984
• https://bugzilla.suse.com/show_bug.cgi?id=1026985
• https://bugzilla.suse.com/show_bug.cgi?id=1026986
• https://bugzilla.suse.com/show_bug.cgi?id=1026987
• https://bugzilla.suse.com/show_bug.cgi?id=1026988
• https://bugzilla.suse.com/show_bug.cgi?id=949399