Bug 1499952 (CVE-2017-14632)

Summary:	CVE-2017-14632 libvorbis: Invalid freeing of uninitialized memory in the function vorbis_analysis_headerout()
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ajax, alexl, caillon+fedoraproject, dkholia, erik-fedora, gnome-sig, hdegoede, klember, rhughes, rstrode, rvokal, sandmann, tuxator
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An invalid free flaw was found in the way libvorbis handled processing of Ogg Vorbis format files. This flaw could potentially be used to crash an application using libvorbis by tricking the application into processing specially crafted files.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-14 10:33:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1480648, 1480649, 1480650
Bug Blocks:	1499962

Description Andrej Nemec 2017-10-09 15:29:01 UTC

A vulnerability was found in libvorbis upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.

Upstream issue:

https://gitlab.xiph.org/xiph/vorbis/issues/2328

Upstream fix:

https://github.com/xiph/vorbis/commit/10064bfdd51f7c59

Bug introduced in:

https://github.com/xiph/vorbis/commit/4b67376da7de

Comment 1 Andrej Nemec 2017-10-09 15:35:29 UTC

Created libvorbis tracking bugs for this issue:

Affects: fedora-all [bug 1480650]


Created mingw-libvorbis tracking bugs for this issue:

Affects: epel-7 [bug 1480649]
Affects: fedora-all [bug 1480648]