The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a
    denial of service (invalid read and application crash) via a crafted audio file with a negative sample
    rate. (CVE-2015-9099)

  - The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to
    cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
    (CVE-2015-9100)

  - The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a
    denial of service (invalid memory read and application crash) via a crafted wav file. (CVE-2017-9412)

  - There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.
    (CVE-2017-11720)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a     denial of service (invalid memory read and application crash) via a crafted wav file. (CVE-2017-9412)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4780-1 advisory.

    It was discovered that LAME incorrectly handled certain audio files. A remote attacker could possibly use     this issue to cause a denial of service. Eight vulnerabilities (CVE-2015-9099, CVE-2015-9100,     CVE-2015-9101, CVE-2017-15018, CVE-2017-11720, CVE-2017-8419, CVE-2017-9412, CVE-2017-15045) only affected     Ubuntu 14.04 ESM, two vulnerabilities (CVE-2017-9410 and CVE-2017-9411) only affected Ubuntu 16.04 ESM,     and one vulnerability (CVE-2017-15019) affected both Ubuntu 14.04 ESM and Ubuntu 16.04.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for lame fixes the following issues :

Lame was updated to version 3.100 :

  - Improved detection of MPEG audio data in RIFF WAVE     files. sf#3545112 Invalid sampling detection

  - New switch --gain <decibel>, range -20.0 to +12.0, a     more convenient way to apply Gain adjustment in     decibels, than the use of --scale <factor>.

  - Fix for sf#3558466 Bug in path handling

  - Fix for sf#3567844 problem with Tag genre

  - Fix for sf#3565659 no progress indication with pipe     input

  - Fix for sf#3544957 scale (empty) silent encode without     warning

  - Fix for sf#3580176 environment variable LAMEOPT doesn't     work anymore

  - Fix for sf#3608583 input file name displayed with wrong     character encoding (on windows console with CP_UTF8)

  - Fix dereference NULL and Buffer not NULL terminated     issues. (CVE-2017-15019 bsc#1082317 CVE-2017-13712     bsc#1082399 CVE-2015-9100 bsc#1082401)

  - Fix dereference of a NULL pointer possible in loop.

  - Make sure functions with SSE instructions maintain their     own properly aligned stack. Thanks to Fabian Greffrath

  - Multiple Stack and Heap Corruptions from Malicious File.
    (CVE-2017-9872 bsc#1082391 CVE-2017-9871 bsc#1082392     CVE-2017-9870 bsc#1082393 CVE-2017-9869 bsc#1082395     CVE-2017-9411 bsc#1082397 CVE-2015-9101 bsc#1082400)

  - CVE-2017-11720: Fix a division by zero vulnerability.
    (bsc#1082311)

  - CVE-2017-9410: Fix fill_buffer_resample function in     libmp3lame/util.c heap-based buffer over-read and ap     (bsc#1082333)

  - CVE-2017-9411: Fix fill_buffer_resample function in     libmp3lame/util.c invalid memory read and application     crash (bsc#1082397)

  - CVE-2017-9412: FIx unpack_read_samples function in     frontend/get_audio.c invalid memory read and application     crash (bsc#1082340)

  - Fix clip detect scale suggestion unaware of scale input     value

  - HIP decoder bug fixed: decoding mixed blocks of lower     sample frequency Layer3 data resulted in internal buffer     overflow.

  - Add lame_encode_buffer_interleaved_int()

ID	Name	Product	Family	Severity
435809	Alpine: multiple lame packages: security update to 3.99.5-r5	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
435809	Alpine: multiple lame packages: security update to 3.99.5-r5	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
424003	Alpine: multiple lame packages: security update to 3.99.5-r6	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424003	Alpine: multiple lame packages: security update to 3.99.5-r6	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
221557	Linux Distros Unpatched Vulnerability : CVE-2017-9412	Nessus	Misc.	medium
405104	Alpine: multiple lame packages: security update to 3.99.5-r6	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405104	Alpine: multiple lame packages: security update to 3.99.5-r6	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
183698	Ubuntu 16.04 ESM : LAME vulnerabilities (USN-4780-1)	Nessus	Ubuntu Local Security Checks	critical
400842	Alpine: multiple lame packages: security update to 3.99.5-r5	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400842	Alpine: multiple lame packages: security update to 3.99.5-r5	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
107048	openSUSE Security Update : lame (openSUSE-2018-214)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-9412

medium

Tenable Plugins

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical