Arch Linux

FS#57485 - [sox] [Security] multiple issues

Attached to Project: Arch Linux
Opened by Morten Linderud (Foxboron) - Monday, 12 February 2018, 23:50 GMT
Last edited by Antonio Rojas (arojas) - Wednesday, 21 February 2018, 23:14 GMT

Task Type	Bug Report
Category	Security
Status	Closed
Assigned To	Eric Belanger (Snowman) Antonio Rojas (arojas) Levente Polyak (anthraxx)
Architecture	All
Severity	High
Priority	Normal
Reported Version
Due in Version	Undecided
Due Date	Undecided
Percent Complete
Votes	0
Private	No

Details

Summary
=======

The package sox is vulnerable to multiple issues including arbitrary code execution and denial of service via CVE-2017-15642, CVE-2017-15372, CVE-2017-15371, CVE-2017-15370, CVE-2017-11359, CVE-2017-11358 and CVE-2017-11332.

Guidance
========

The sourceforge upstream is dead, however patches are available from debian (all the "*CVE*.patch" files) and a github repo.

https://github.com/mansr/sox/commits/master
https://sources.debian.org/data/main/s/sox/14.4.2-3/debian/patches/

References
==========

https://security.archlinux.org/AVG-610
https://github.com/mansr/sox/commit/0be259eaa9ce3f3fa587a3ef0cf2c0b9c73167a2
https://lists.debian.org/debian-lts-announce/2017/11/msg00043.html
https://github.com/mansr/sox/commit/001c337552912d286ba68086ac378f6fdc1e8b50
https://github.com/mansr/sox/commit/818bdd0ccc1e5b6cae742c740c17fd414935cf39
https://github.com/mansr/sox/commit/ef3d8be0f80cbb650e4766b545d61e10d7a24c9e
http://seclists.org/fulldisclosure/2017/Jul/81
https://github.com/mansr/sox/commit/8b590b3a52f4ccc4eea3f41b4a067c38b3565b60
https://github.com/mansr/sox/commit/6cb44a44b9eda6b321ccdbf6483348d4a9798b00
https://github.com/mansr/sox/commit/7405bcaacb1ded8c595cb751d407cf738cb26571

This task depends upon

Closed by Antonio Rojas (arojas)
Wednesday, 21 February 2018, 23:14 GMT
Reason for closing: Fixed
Additional comments about closing: sox 14.4.2-3

	Tasks related to this task (0)

Duplicate tasks of this task (0)

Loading...