Package: release.debian.org
Severity: normal
Tags: jessie
User: release.debian.org@packages.debian.org
Usertags: pu
Hi,
lame 3.99.5+repack1-7+deb8u1 is affected by several vulnerabilities in
the code used to read the input file. These issues are not present in
any Debian release after Jessie because the package switched to
libsndfile to read and write audio files. The upstream code itself was
recently fixed in 3.100.
Following advices from lame's upstream and from lame's maintainer I
proposed the attached patch. In this patch we modify the Jessie
package to use libsndfile instead of the internal code. The security
team considers these issues not worth a DSA but recommended me to
submit this patch as jessie-pu.
You can find more detailed information about this patch on the
debian-lts ML[0].
Thanks !
Regards,
Hugo
[0] https://lists.debian.org/debian-lts/2018/05/msg00081.html
--
Hugo Lefeuvre (hle) | www.owl.eu.com
4096/ 9C4F C8BF A4B0 8FC5 48EB 56B8 1962 765B B9A8 BACA
diff -Nru lame-3.99.5+repack1/debian/changelog lame-3.99.5+repack1/debian/changelog --- lame-3.99.5+repack1/debian/changelog 2015-06-15 09:05:28.000000000 -0400 +++ lame-3.99.5+repack1/debian/changelog 2018-05-27 17:30:02.000000000 -0400 @@ -1,3 +1,16 @@ +lame (3.99.5+repack1-7+deb8u2) oldstable; urgency=high + + [ Fabian Greffrath ] + + * Build the frontend with the sndfile io routines, RAW PCM and WAV can be + read from stdin since at least 3.99.0 (Closes: #867725). + - Add Build-Depends: libsndfile1-dev. + + Addressed CVEs: CVE-2017-9872, CVE-2017-9871, CVE-2017-9870, CVE-2017-9869, + CVE-2017-15046, CVE-2017-15045, CVE-2017-15018. + + -- Hugo Lefeuvre <hle@debian.org> Sun, 27 May 2018 17:30:02 -0400 + lame (3.99.5+repack1-7+deb8u1) jessie; urgency=medium * debian/patches/force_align_arg_pointer.patch: Enable functions with SSE diff -Nru lame-3.99.5+repack1/debian/control lame-3.99.5+repack1/debian/control --- lame-3.99.5+repack1/debian/control 2015-06-15 09:03:04.000000000 -0400 +++ lame-3.99.5+repack1/debian/control 2018-05-27 17:16:42.000000000 -0400 @@ -9,6 +9,7 @@ debhelper (>= 9), dh-autoreconf, libncurses5-dev, + libsndfile1-dev, pkg-config, nasm [i386] Standards-Version: 3.9.5 diff -Nru lame-3.99.5+repack1/debian/rules lame-3.99.5+repack1/debian/rules --- lame-3.99.5+repack1/debian/rules 2015-06-15 09:03:04.000000000 -0400 +++ lame-3.99.5+repack1/debian/rules 2018-05-27 17:16:42.000000000 -0400 @@ -9,4 +9,4 @@ --enable-dynamic-frontends \ --enable-expopt=full \ --enable-nasm \ - --with-fileio=lame + --with-fileio=sndfile
Attachment:
signature.asc
Description: PGP signature