GLSA-200710-04 : libsndfile: Buffer overflow
High Nessus Plugin ID 26944
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200710-04 (libsndfile: Buffer overflow)
Robert Buchholz of the Gentoo Security team discovered that the flac_buffer_copy() function does not correctly handle FLAC streams with variable block sizes which leads to a heap-based buffer overflow (CVE-2007-4974).
A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted FLAC file or network stream with an application using libsndfile. This might lead to the execution of arbitrary code with privileges of the user playing the file.
There is no known workaround at this time.
SolutionAll libsndfile users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=media-libs/libsndfile-1.0.17-r1'