oCERT reports sox vulnerabilities found by Michele Spagnuolo of Google Security Team: """ We have 2 heap-oob (one sometimes also causes SIGSEGV), 1 null pointer dereference and 6 divisions by zero that reproduce in both 14.3.1 and 14.4.1. The memory corruptions on the heap are potentially exploitable. The divisions by zero and the *(0x0), of course, are not security relevant. The maintainer provided 2 patches (they are attached) which have been validated by original report. """ Acknowledgement: Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter.
Created attachment 969552 [details] Upstream patch 1 - 0001-Check-for-minimum-size-sphere-headers Upstream patch provided with the report
Created attachment 969553 [details] Upstream patch 2 - 0002-More-checks-for-invalid-MS-ADPCM-blocks Upstream patch provided with the report
The report does not indicate if the above two patches only address 2 heap OOB access issues, or if they should address NULL deref and division by zero issues.
External Reference: http://www.ocert.org/advisories/ocert-2014-010.html
Created sox tracking bugs for this issue: Affects: fedora-all [bug 1184079]
sox-14.4.1-7.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
The patches above fix the 2 OOB write issues. The other issues are without any security impact in this case, but they appear to be unfixed. Statement: This issue affects the versions of sox as shipped with Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2014-8145