Bug 1499952 (CVE-2017-14632)

Summary: CVE-2017-14632 libvorbis: Invalid freeing of uninitialized memory in the function vorbis_analysis_headerout()
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ajax, alexl, caillon+fedoraproject, dkholia, erik-fedora, gnome-sig, hdegoede, klember, rhughes, rstrode, rvokal, sandmann, tuxator
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
An invalid free flaw was found in the way libvorbis handled processing of Ogg Vorbis format files. This flaw could potentially be used to crash an application using libvorbis by tricking the application into processing specially crafted files.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-11-14 10:33:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1480648, 1480649, 1480650    
Bug Blocks: 1499962    

Description Andrej Nemec 2017-10-09 15:29:01 UTC 
A vulnerability was found in libvorbis upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.

Upstream issue:

https://gitlab.xiph.org/xiph/vorbis/issues/2328

Upstream fix:

https://github.com/xiph/vorbis/commit/10064bfdd51f7c59

Bug introduced in:

https://github.com/xiph/vorbis/commit/4b67376da7de
Comment 1 Andrej Nemec 2017-10-09 15:35:29 UTC 
Created libvorbis tracking bugs for this issue:

Affects: fedora-all [bug 1480650]


Created mingw-libvorbis tracking bugs for this issue:

Affects: epel-7 [bug 1480649]
Affects: fedora-all [bug 1480648]