CVEs have been assigned for two security issues fixed upstream in libextractor: http://openwall.com/lists/oss-security/2017/10/12/15 It says version 1.4 is affected but doesn't explicitly say that earlier versions aren't, so Mageia 5, Mageia 6, or Cauldron may also be affected.
Assigning to the registered maintainer.
CC: (none) => marja11Assignee: bugsquad => anssi.hannula
Fedora has issued an advisory on October 30: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Z3JVQF4TREMGJ5RI6JHPIZ6STU3H572K/ It updates to 1.6 which fixes more security issues.
Whiteboard: (none) => MGA6TOO, MGA5TOO
libextractor-1.6-1.mga7 uploaded for Cauldron by David.
Whiteboard: MGA6TOO, MGA5TOO => MGA5TOOCC: (none) => geiger.david68210Version: Cauldron => 6
Done also for mga6 and mga5!
Advisory: ======================== Updated libextractor packages fix security vulnerabilities: In 'EXTRACTOR_wav_extract_method' function of wav_extractor.c, the program does not check the value of sample_rate, with a crafted file, the sample_rate can be set to zero, resulting in a divide by zero and a crash (CVE-2017-15266). NULL Pointer Dereference vulneribility in libextract when getting flac meta from libFlac (CVE-2017-15267). NULL Pointer Dereference vulneribility in libextractor EXTRACTOR_nsf_extract_method() (rhbz#1501695). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15266 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15267 http://openwall.com/lists/oss-security/2017/10/12/15 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Z3JVQF4TREMGJ5RI6JHPIZ6STU3H572K/ ======================== Updated packages in core/updates_testing: ======================== extract-1.6-1.mga5 libextractor-common-1.6-1.mga5 libextractor3-1.6-1.mga5 libextractor_common1-1.6-1.mga5 libextractor-devel-1.6-1.mga5 extract-1.6-1.mga6 libextractor-common-1.6-1.mga6 libextractor3-1.6-1.mga6 libextractor_common1-1.6-1.mga6 libextractor-devel-1.6-1.mga6 from SRPMS: libextractor-1.6-1.mga5.src.rpm libextractor-1.6-1.mga6.src.rpm
Assignee: anssi.hannula => qa-bugsCC: (none) => anssi.hannulaSeverity: normal => critical
mga6::x86_64 POC files available at https://bugzilla.redhat.com/show_bug.cgi?id=1499599 CVE-2017-15266 extract-wav_extractor-119.dos $ extract -i extract-wav_extractor-119.dos Keywords for file extract-wav_extractor-119.dos: mimetype - audio/x-wav Floating point exception (core dumped) https://bugzilla.redhat.com/show_bug.cgi?id=1499600 CVE-2017-15267 extract-flac_metadata-344.crash $ extract -i extract-flac_metadata-344.crash Keywords for file extract-flac_metadata-344.crash: resource type - 44100 Hz, 2 channels Segmentation fault (core dumped) Updated all five packages from updates testing. Ran the POCs. $ extract -i extract-wav_extractor-119.dos Keywords for file extract-wav_extractor-119.dos: mimetype - audio/x-wav $ extract -i extract-flac_metadata-344.crash Keywords for file extract-flac_metadata-344.crash: resource type - 44100 Hz, 2 channels mimetype - audio/x-flac These results indicate that the problems are intercepted and that the queries can be satisfied as well. The command line tool uses the libraries to extract metadata from files. Use extract --help to see what the options are. $ extract -L This lists all the recognized keywords, which can be used with the --print switch. $ extract --print='video dimensions' Lesénigmesdelâgedelapierre1-2.mp4 Keywords for file Lesénigmesdelâgedelapierre1-2.mp4: video dimensions - 1280x720 $ extract --print='frame rate' InterviewWithATimeTraveller.mp4 Keywords for file InterviewWithATimeTraveller.mp4: frame rate - 24000/1001 $ extract -i SophieMarceau_5.jpg Keywords for file SophieMarceau_5.jpg: mimetype - image/jpeg image dimensions - 1280x960 image dimensions - 1280x960 thumbnail - (binary, 11928 bytes) mimetype - image/jpeg unknown - sof-marker=0 video dimensions - 1280x960 video depth - 24 pixel aspect ratio - 1/1 mimetype - image/jpeg Not sure what is going on there - repetitions and 'video dimensions'. $ extract -i -g SophieMarceau_5.jpg | grep image SophieMarceau_5.jpg `image/jpeg' `1280x960' `1280x960' `image/jpeg' `sof-marker=0' `1280x960' `24' `1/1' `image/jpeg' $ cd /usr/lib64/vlc $ extract -i vlc-cache-gen Keywords for file vlc-cache-gen: mimetype - application/x-executable $ extract -i libvlc_pulse.so.0.0.0 Keywords for file libvlc_pulse.so.0.0.0: mimetype - application/x-sharedlib $ urpmq --whatrequires lib64extractor3 extract lib64extractor-devel lib64extractor3 vdr-plugin-xineliboutput The impression is that it works. Giving this the OK for 64 bits.
CC: (none) => tarazed25
Whiteboard: MGA5TOO => MGA5TOO MGA6-64-OK
MGA5-32 on Asus A6000VM Xfce No installation issues. Following Len's examples above: $ extract -L gereserveerd MIME-type ingebedde bestandsnaam opmerking and loads more $ extract --print='video-afmetingen' noor20112008.11.21_10-46-04.avi Trefwoorden voor bestand noor20112008.11.21_10-46-04.avi: video-afmetingen - 720x576 $ extract --print='frame-snelheid' noor20112008.11.21_10-46-04.avi Trefwoorden voor bestand noor20112008.11.21_10-46-04.avi: frame-snelheid - 25/1 ]$ extract -i BILD3766.JPG Trefwoorden voor bestand BILD3766.JPG: cameramerk - Supra cameramodel - Super Slim XS7 oriëntatie - top, left aanmaakdatum - 2015:09:24 08:57:16 belichtingsafwijking - 0 EV flits - No, auto and some more Seems to work OK
Whiteboard: MGA5TOO MGA6-64-OK => MGA5TOO MGA6-64-OK MGA5-32-OKCC: (none) => herman.viaene
Keywords: (none) => advisory, validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2017-0413.html
Status: NEW => RESOLVEDResolution: (none) => FIXED