Source: libgig X-Debbugs-CC: t...@security.debian.org secure-testing-t...@lists.alioth.debian.org Severity: grave Tags: security
Hi, the following vulnerabilities were published for libgig. See http://seclists.org/fulldisclosure/2017/Aug/39 for the initial report with reproducer files. CVE-2017-12950[0]: | The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows | remote attackers to cause a denial of service (NULL pointer | dereference and application crash) via a crafted gig file. CVE-2017-12951[1]: | The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in | libgig 4.0.0 allows remote attackers to cause a denial of service | (stack-based buffer over-read and application crash) via a crafted gig | file. CVE-2017-12952[2]: | The LoadString function in helper.h in libgig 4.0.0 allows remote | attackers to cause a denial of service (NULL pointer dereference and | application crash) via a crafted gig file. CVE-2017-12953[3]: | The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in | libgig 4.0.0 allows remote attackers to cause a denial of service | (invalid memory write and application crash) via a crafted gig file. CVE-2017-12954[4]: | The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig | 4.0.0 allows remote attackers to cause a denial of service (invalid | memory read and application crash) via a crafted gig file. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-12950 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12950 [1] https://security-tracker.debian.org/tracker/CVE-2017-12951 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12951 [2] https://security-tracker.debian.org/tracker/CVE-2017-12952 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12952 [3] https://security-tracker.debian.org/tracker/CVE-2017-12953 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12953 [4] https://security-tracker.debian.org/tracker/CVE-2017-12954 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12954 Please adjust the affected versions in the BTS as needed. -- Raphaël Hertzog ◈ Debian Developer Support Debian LTS: https://www.freexian.com/services/debian-lts.html Learn to master Debian: https://debian-handbook.info/get/
