Issued:
2020-09-29
Updated:
2020-09-29

RHSA-2020:3877 - Security Advisory

Synopsis

Moderate: audiofile security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for audiofile is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The Audio File library is an implementation of the Audio File Library from SGI, which provides an API for accessing audio file formats like AIFF/AIFF-C, WAVE, and NeXT/Sun .snd/.au files.

Security Fix(es):

  • audiofile: Heap-based buffer overflow in Expand3To4Module::run() when running sfconvert (CVE-2018-17095)
  • audiofile: NULL pointer dereference in ModuleState::setup() in modules/ModuleState.cpp allows for denial of service via crafted file (CVE-2018-13440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server 7 x86_64
  • Red Hat Enterprise Linux Workstation 7 x86_64
  • Red Hat Enterprise Linux Desktop 7 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 7 s390x
  • Red Hat Enterprise Linux for Power, big endian 7 ppc64
  • Red Hat Enterprise Linux for Scientific Computing 7 x86_64
  • Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

  • BZ - 1600367 - CVE-2018-13440 audiofile: NULL pointer dereference in ModuleState::setup() in modules/ModuleState.cpp allows for denial of service via crafted file
  • BZ - 1631088 - CVE-2018-17095 audiofile: Heap-based buffer overflow in Expand3To4Module::run() when running sfconvert

Red Hat Enterprise Linux Server 7

SRPM
audiofile-0.3.6-9.el7.src.rpm SHA-256: 57d35d092ef5326a798f33f1bd9ed5ac13d1372bad5c81e16f184a8c11b8a149
x86_64
audiofile-0.3.6-9.el7.i686.rpm SHA-256: 7fa46617fcf38569816f21e67315e4df5dae8358dedc245512ad3072e8138e5f
audiofile-0.3.6-9.el7.x86_64.rpm SHA-256: 2e86ec91d81eab488abca1b30010bbfd446f3b75b8eddb12d5080f40beee8166
audiofile-debuginfo-0.3.6-9.el7.i686.rpm SHA-256: 60e33f55ba8090c6c49a2c08697639b3862382b39368a930175b940283c8f0d8
audiofile-debuginfo-0.3.6-9.el7.x86_64.rpm SHA-256: 6b3dd2313674e738716eaca2742e22514e24cf58946514bb640b10681455c852
audiofile-devel-0.3.6-9.el7.i686.rpm SHA-256: 1e23dfdb4c28722ad7fe661006c1706ba9706a2aacd13f865ddc8921f4914adc
audiofile-devel-0.3.6-9.el7.x86_64.rpm SHA-256: bb21bf8b57079ae006b874e54e111194a6f23f53a565be30cd150741f1d7f3cc

Red Hat Enterprise Linux Workstation 7

SRPM
audiofile-0.3.6-9.el7.src.rpm SHA-256: 57d35d092ef5326a798f33f1bd9ed5ac13d1372bad5c81e16f184a8c11b8a149
x86_64
audiofile-0.3.6-9.el7.i686.rpm SHA-256: 7fa46617fcf38569816f21e67315e4df5dae8358dedc245512ad3072e8138e5f
audiofile-0.3.6-9.el7.x86_64.rpm SHA-256: 2e86ec91d81eab488abca1b30010bbfd446f3b75b8eddb12d5080f40beee8166
audiofile-debuginfo-0.3.6-9.el7.i686.rpm SHA-256: 60e33f55ba8090c6c49a2c08697639b3862382b39368a930175b940283c8f0d8
audiofile-debuginfo-0.3.6-9.el7.x86_64.rpm SHA-256: 6b3dd2313674e738716eaca2742e22514e24cf58946514bb640b10681455c852
audiofile-devel-0.3.6-9.el7.i686.rpm SHA-256: 1e23dfdb4c28722ad7fe661006c1706ba9706a2aacd13f865ddc8921f4914adc
audiofile-devel-0.3.6-9.el7.x86_64.rpm SHA-256: bb21bf8b57079ae006b874e54e111194a6f23f53a565be30cd150741f1d7f3cc

Red Hat Enterprise Linux Desktop 7

SRPM
audiofile-0.3.6-9.el7.src.rpm SHA-256: 57d35d092ef5326a798f33f1bd9ed5ac13d1372bad5c81e16f184a8c11b8a149
x86_64
audiofile-0.3.6-9.el7.i686.rpm SHA-256: 7fa46617fcf38569816f21e67315e4df5dae8358dedc245512ad3072e8138e5f
audiofile-0.3.6-9.el7.x86_64.rpm SHA-256: 2e86ec91d81eab488abca1b30010bbfd446f3b75b8eddb12d5080f40beee8166
audiofile-debuginfo-0.3.6-9.el7.i686.rpm SHA-256: 60e33f55ba8090c6c49a2c08697639b3862382b39368a930175b940283c8f0d8
audiofile-debuginfo-0.3.6-9.el7.x86_64.rpm SHA-256: 6b3dd2313674e738716eaca2742e22514e24cf58946514bb640b10681455c852
audiofile-devel-0.3.6-9.el7.i686.rpm SHA-256: 1e23dfdb4c28722ad7fe661006c1706ba9706a2aacd13f865ddc8921f4914adc
audiofile-devel-0.3.6-9.el7.x86_64.rpm SHA-256: bb21bf8b57079ae006b874e54e111194a6f23f53a565be30cd150741f1d7f3cc

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
audiofile-0.3.6-9.el7.src.rpm SHA-256: 57d35d092ef5326a798f33f1bd9ed5ac13d1372bad5c81e16f184a8c11b8a149
s390x
audiofile-0.3.6-9.el7.s390.rpm SHA-256: 5c92e14fba1afb1a57a929355ad38f963e246c53f168443816871bf2b053762b
audiofile-0.3.6-9.el7.s390x.rpm SHA-256: 6c850e7d12770ac67229f24b4f9435722be209dc38aa231d8fc4cb6f80b69dee
audiofile-debuginfo-0.3.6-9.el7.s390.rpm SHA-256: c5512000fa34491a414907c8a8eb322605c6889d85b04159a051c0bac98c0c5d
audiofile-debuginfo-0.3.6-9.el7.s390x.rpm SHA-256: cd699f9957ce0415a1226f6ad5a5592f046b726a21d5257802e77a6d624626b1
audiofile-devel-0.3.6-9.el7.s390.rpm SHA-256: 8feb96b9702adc81983bf5f8981aacab0d955bfe8bcf85b41d82efa9ecf35981
audiofile-devel-0.3.6-9.el7.s390x.rpm SHA-256: 9bc2a10bdca745a90d218ac7bc4d573ceb42547a02c75630d92b5782c491bc24

Red Hat Enterprise Linux for Power, big endian 7

SRPM
audiofile-0.3.6-9.el7.src.rpm SHA-256: 57d35d092ef5326a798f33f1bd9ed5ac13d1372bad5c81e16f184a8c11b8a149
ppc64
audiofile-0.3.6-9.el7.ppc.rpm SHA-256: 68f88f0af90fc3ef65827bdd60c8319f2b1cae57919ef1f30d353bb608f496e6
audiofile-0.3.6-9.el7.ppc64.rpm SHA-256: 17c3219a7f7d52bf8010f7ecbfefdaf33cac6e56e7dc8d9f21b714a986d1060e
audiofile-debuginfo-0.3.6-9.el7.ppc.rpm SHA-256: ca80933f1481d4a5804fa2f205d4e1832195a006ebd8f045397a14e8fb0a5a11
audiofile-debuginfo-0.3.6-9.el7.ppc64.rpm SHA-256: caaba66a85c674928a5ccbdf7d141244d8dabc9ce96d1c701c6a81ab72594515
audiofile-devel-0.3.6-9.el7.ppc.rpm SHA-256: b77560918221603d2932c4dc3903c39dd0f12d10776e38f58e77f2f1a3836522
audiofile-devel-0.3.6-9.el7.ppc64.rpm SHA-256: a0d846eb3c5edc57c96490a96d65d1eb3408a56e4c88fd0165d6b280468360df

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
audiofile-0.3.6-9.el7.src.rpm SHA-256: 57d35d092ef5326a798f33f1bd9ed5ac13d1372bad5c81e16f184a8c11b8a149
x86_64
audiofile-0.3.6-9.el7.i686.rpm SHA-256: 7fa46617fcf38569816f21e67315e4df5dae8358dedc245512ad3072e8138e5f
audiofile-0.3.6-9.el7.x86_64.rpm SHA-256: 2e86ec91d81eab488abca1b30010bbfd446f3b75b8eddb12d5080f40beee8166
audiofile-debuginfo-0.3.6-9.el7.i686.rpm SHA-256: 60e33f55ba8090c6c49a2c08697639b3862382b39368a930175b940283c8f0d8
audiofile-debuginfo-0.3.6-9.el7.x86_64.rpm SHA-256: 6b3dd2313674e738716eaca2742e22514e24cf58946514bb640b10681455c852
audiofile-devel-0.3.6-9.el7.i686.rpm SHA-256: 1e23dfdb4c28722ad7fe661006c1706ba9706a2aacd13f865ddc8921f4914adc
audiofile-devel-0.3.6-9.el7.x86_64.rpm SHA-256: bb21bf8b57079ae006b874e54e111194a6f23f53a565be30cd150741f1d7f3cc

Red Hat Enterprise Linux for Power, little endian 7

SRPM
audiofile-0.3.6-9.el7.src.rpm SHA-256: 57d35d092ef5326a798f33f1bd9ed5ac13d1372bad5c81e16f184a8c11b8a149
ppc64le
audiofile-0.3.6-9.el7.ppc64le.rpm SHA-256: c73f41b4967535f754fb0f8e31692610adc0aef6b86812007fd84e84526c5a6b
audiofile-debuginfo-0.3.6-9.el7.ppc64le.rpm SHA-256: 16cf93aae1ca8385dc9d0323f2f3656f9c62e667f04f7b097175ab01de4f0e84
audiofile-devel-0.3.6-9.el7.ppc64le.rpm SHA-256: 1667c1be9d226760b4de1096d3dfa0eec89c7b04890875d18b0ea6e462328b8c

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.