Issued:
2020-04-28
Updated:
2020-04-28

RHSA-2020:1636 - Security Advisory

Synopsis

Moderate: libsndfile security update

Type/Severity

Security Advisory: Moderate

Topic

An update for libsndfile is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV.

Security Fix(es):

  • libsndfile: stack-based buffer overflow in sndfile-deinterleave utility (CVE-2018-13139)
  • libsndfile: buffer over-read in the function i2alaw_array in alaw.c (CVE-2018-19662)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 1598480 - CVE-2018-13139 libsndfile: stack-based buffer overflow in sndfile-deinterleave utility
  • BZ - 1659631 - CVE-2018-19662 libsndfile: buffer over-read in the function i2alaw_array in alaw.c

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
libsndfile-1.0.28-10.el8.src.rpm SHA-256: c1892e8b0dd4757a1d9a24b441f296bdc4cfccb3ae851a465ae7d5f52a5059fa
x86_64
libsndfile-1.0.28-10.el8.i686.rpm SHA-256: a5f10479e574b5b042f4713861617455f9436d340d80dcc983753a3de478a4cd
libsndfile-1.0.28-10.el8.x86_64.rpm SHA-256: 6ad58edf4f33d5b00f6b5079459a0b4febbbf138f94ff58a28ba5e3ee531f55a
libsndfile-debuginfo-1.0.28-10.el8.i686.rpm SHA-256: a264734cef78ce0951162acb3f06ac3857aa120bd27570e209f6d3c31bc1b916
libsndfile-debuginfo-1.0.28-10.el8.x86_64.rpm SHA-256: 0cfea33910cc46263f59a4ae004472024aec8cd758e5610245f56abea6d8fdb5
libsndfile-debugsource-1.0.28-10.el8.i686.rpm SHA-256: c05d2c8a5bbd9624d2a445d9a57dd2891e16948971816a41b0696ffc9e3f4000
libsndfile-debugsource-1.0.28-10.el8.x86_64.rpm SHA-256: 8032d7e408437ef225ac86b3c4246a3683a4091cd8ba7183c72e8ee88b2a54f1
libsndfile-utils-debuginfo-1.0.28-10.el8.i686.rpm SHA-256: 841738ef9c7e0fba4d17014371be7437c28339a2f15052b8650de712e131f66d
libsndfile-utils-debuginfo-1.0.28-10.el8.x86_64.rpm SHA-256: 285ea891a8fbf433e18b757e7c885a4d885a1b7b6d4cb8d3c7d016a4ab709a7d

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
libsndfile-1.0.28-10.el8.src.rpm SHA-256: c1892e8b0dd4757a1d9a24b441f296bdc4cfccb3ae851a465ae7d5f52a5059fa
s390x
libsndfile-1.0.28-10.el8.s390x.rpm SHA-256: beb846588b4e296f65583b5ea7f96b5a2df58f0b6f2b9f49f5f526f2949dd986
libsndfile-debuginfo-1.0.28-10.el8.s390x.rpm SHA-256: f1eb520e1fc763c70b8155008ccb1494f67cd81bf644ec65bd0494cfac94ca9f
libsndfile-debugsource-1.0.28-10.el8.s390x.rpm SHA-256: e3a807aa8432bab121c6d695d1612643d8c6311c791024858f8cdb4f505dac83
libsndfile-utils-debuginfo-1.0.28-10.el8.s390x.rpm SHA-256: 95ef625a7e19d806685c3c220dd43a87ea217b3702d45e0012ccfd9236a80b3d

Red Hat Enterprise Linux for Power, little endian 8

SRPM
libsndfile-1.0.28-10.el8.src.rpm SHA-256: c1892e8b0dd4757a1d9a24b441f296bdc4cfccb3ae851a465ae7d5f52a5059fa
ppc64le
libsndfile-1.0.28-10.el8.ppc64le.rpm SHA-256: 068aae14dfa893c756bc85f15a5f9ece4b9374eaa226f3a22447a5b1ba45e88d
libsndfile-debuginfo-1.0.28-10.el8.ppc64le.rpm SHA-256: e3dc9da42fe7aed5a8965789142a510eb39049830bdc22ff7f03a5dd0d8a1d3d
libsndfile-debugsource-1.0.28-10.el8.ppc64le.rpm SHA-256: c1877bfe8108498bd4de574e09bb17fda4282eeb3952c04523095b33fea3cb12
libsndfile-utils-debuginfo-1.0.28-10.el8.ppc64le.rpm SHA-256: 9ab73b9c9d562840e45686477a2b4acf7ee594725eb43f950dc7312a18dbe471

Red Hat Enterprise Linux for ARM 64 8

SRPM
libsndfile-1.0.28-10.el8.src.rpm SHA-256: c1892e8b0dd4757a1d9a24b441f296bdc4cfccb3ae851a465ae7d5f52a5059fa
aarch64
libsndfile-1.0.28-10.el8.aarch64.rpm SHA-256: 1fad636fbf0776d009f1d6bdfcfb24aea1e72fe4d6a7827bdf8f27b94b4c8bc1
libsndfile-debuginfo-1.0.28-10.el8.aarch64.rpm SHA-256: a45b007880efb0330835cbbe63ce412c2c3760da789b39b3178b84ee4610be70
libsndfile-debugsource-1.0.28-10.el8.aarch64.rpm SHA-256: 2e131a8d709c35c6725a47ec8d3c27c70d754c740cdc2c15bcad48151ebfc683
libsndfile-utils-debuginfo-1.0.28-10.el8.aarch64.rpm SHA-256: 5a42b372b0c9782297c7c843e9e6b5a8f25b573c7853ab9d809e8143f45b778e

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
libsndfile-debuginfo-1.0.28-10.el8.i686.rpm SHA-256: a264734cef78ce0951162acb3f06ac3857aa120bd27570e209f6d3c31bc1b916
libsndfile-debuginfo-1.0.28-10.el8.x86_64.rpm SHA-256: 0cfea33910cc46263f59a4ae004472024aec8cd758e5610245f56abea6d8fdb5
libsndfile-debugsource-1.0.28-10.el8.i686.rpm SHA-256: c05d2c8a5bbd9624d2a445d9a57dd2891e16948971816a41b0696ffc9e3f4000
libsndfile-debugsource-1.0.28-10.el8.x86_64.rpm SHA-256: 8032d7e408437ef225ac86b3c4246a3683a4091cd8ba7183c72e8ee88b2a54f1
libsndfile-devel-1.0.28-10.el8.i686.rpm SHA-256: 895f00dd5157313b5debdec9b79666cf2eb285cd73948156ee45e3408544fd6a
libsndfile-devel-1.0.28-10.el8.x86_64.rpm SHA-256: 8207bacabe06e5e8cb166fff4c4486828b4537ac988cd1c61bd3cba32a700eaa
libsndfile-utils-debuginfo-1.0.28-10.el8.i686.rpm SHA-256: 841738ef9c7e0fba4d17014371be7437c28339a2f15052b8650de712e131f66d
libsndfile-utils-debuginfo-1.0.28-10.el8.x86_64.rpm SHA-256: 285ea891a8fbf433e18b757e7c885a4d885a1b7b6d4cb8d3c7d016a4ab709a7d

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
libsndfile-debuginfo-1.0.28-10.el8.ppc64le.rpm SHA-256: e3dc9da42fe7aed5a8965789142a510eb39049830bdc22ff7f03a5dd0d8a1d3d
libsndfile-debugsource-1.0.28-10.el8.ppc64le.rpm SHA-256: c1877bfe8108498bd4de574e09bb17fda4282eeb3952c04523095b33fea3cb12
libsndfile-devel-1.0.28-10.el8.ppc64le.rpm SHA-256: 17c837499b2bcfd0657cbbafe8618ff5fb017a86f60740bb9b9fbb63995ad901
libsndfile-utils-debuginfo-1.0.28-10.el8.ppc64le.rpm SHA-256: 9ab73b9c9d562840e45686477a2b4acf7ee594725eb43f950dc7312a18dbe471

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
libsndfile-debuginfo-1.0.28-10.el8.aarch64.rpm SHA-256: a45b007880efb0330835cbbe63ce412c2c3760da789b39b3178b84ee4610be70
libsndfile-debugsource-1.0.28-10.el8.aarch64.rpm SHA-256: 2e131a8d709c35c6725a47ec8d3c27c70d754c740cdc2c15bcad48151ebfc683
libsndfile-devel-1.0.28-10.el8.aarch64.rpm SHA-256: 12396601b84172948ffcd3b19c7ab4b729d4b355f0ac0997211545aa20af4eca
libsndfile-utils-debuginfo-1.0.28-10.el8.aarch64.rpm SHA-256: 5a42b372b0c9782297c7c843e9e6b5a8f25b573c7853ab9d809e8143f45b778e

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
libsndfile-debuginfo-1.0.28-10.el8.s390x.rpm SHA-256: f1eb520e1fc763c70b8155008ccb1494f67cd81bf644ec65bd0494cfac94ca9f
libsndfile-debugsource-1.0.28-10.el8.s390x.rpm SHA-256: e3a807aa8432bab121c6d695d1612643d8c6311c791024858f8cdb4f505dac83
libsndfile-devel-1.0.28-10.el8.s390x.rpm SHA-256: 6f97881b2608806133f7dd45d2f65c46ce3df6741793baf4845b38a62f74e25d
libsndfile-utils-debuginfo-1.0.28-10.el8.s390x.rpm SHA-256: 95ef625a7e19d806685c3c220dd43a87ea217b3702d45e0012ccfd9236a80b3d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.