openSUSE has issued advisories on June 19: https://lists.opensuse.org/opensuse-updates/2018-06/msg00108.html https://lists.opensuse.org/opensuse-updates/2018-06/msg00109.html Mageia 5 and Mageia 6 are also affected.
Status comment: (none) => Patch available from openSUSEWhiteboard: (none) => MGA6TOO
openSUSE has issued an advisory today (August 16): https://lists.opensuse.org/opensuse-updates/2018-08/msg00089.html It fixes two new issues.
Status comment: Patch available from openSUSE => Patches available from openSUSESummary: aubio new security issue CVE-2017-17554 => aubio new security issues CVE-2017-17554 and CVE-2018-1452[23]
All fixes were included in upstream 0.4.8 (uploaded by Shlomi for Cauldron).
Version: Cauldron => 6Whiteboard: MGA6TOO => (none)
Advisory: ======================== Updated aubio packages fix security vulnerabilities: NULL pointer dereference in the function aubio_source_avcodec_readframe which may lead to DoS when playing a crafted audio file (CVE-2017-17554). A crash in aubio_pitch_set_unit (CVE-2018-14522). A buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (CVE-2018-14523). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17554 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14522 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14523 https://lists.opensuse.org/opensuse-updates/2018-08/msg00089.html ======================== Updated packages in core/updates_testing: ======================== aubio-0.4.2-2.2.mga6 libaubio4-0.4.2-2.2.mga6 libaubio-devel-0.4.2-2.2.mga6 python-aubio-0.4.2-2.2.mga6 from aubio-0.4.2-2.2.mga6.src.rpm
CC: (none) => shlomifAssignee: shlomif => qa-bugs
MGA6-32 MATE on IBM Thinkpad R50e No installation issues Ref bug 22849 Comment 5 for tests at CLI: $ aubiotrack -i 02Zapfenstreich.wav 1.486735 1.998776 2.510839 and a lot more $ aubiopitch -o test -i 02Zapfenstreich.wav produces an audio file "test" about half the size of the wav, but audio so distorted it is not recognizable anymore. $ file test test: RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 44100 Hz Seems OK to me, failing to understand most of the operations in this package.
Whiteboard: (none) => MGA6-32-OKCC: (none) => herman.viaene
Keywords: (none) => advisory, validated_updateCC: (none) => lewyssmith, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2019-0016.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED