Bugzilla – Bug 1188540
VUL-0: CVE-2021-3246: libsndfile: heap buffer overflow vulnerability in msadpcm_decode_block
Last modified: 2024-05-13 18:31:01 UTC
CVE-2021-3246 A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3246 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3246 https://github.com/libsndfile/libsndfile/issues/687
The upstream commit deb669ee8be55a94565f6f8a6b60890c2e7c6f32 ms_adpcm: Fix and extend size checks seems covering it. Backported and submitted.
Do we need the fix for older releases (SLE10-* and SLE11)? I thought the fix wasn't taken for older release any longer in the previous security bug of libsndfile.
you already submitted to all the supported codestream, no other codestreams require this patch. Thank you
OK, then let's reassign back to security team. Thanks.
SUSE-SU-2021:14769-1: An update that fixes one vulnerability is now available. Category: security (critical) Bug References: 1188540 CVE References: CVE-2021-3246 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): libsndfile-1.0.20-2.19.15.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): libsndfile-1.0.20-2.19.15.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): libsndfile-1.0.20-2.19.15.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): libsndfile-1.0.20-2.19.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:2615-1: An update that fixes four vulnerabilities is now available. Category: security (critical) Bug References: 1100167,1116993,1117954,1188540 CVE References: CVE-2018-13139,CVE-2018-19432,CVE-2018-19758,CVE-2021-3246 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): libsndfile-1.0.25-36.23.1 SUSE OpenStack Cloud 9 (src): libsndfile-1.0.25-36.23.1 SUSE OpenStack Cloud 8 (src): libsndfile-1.0.25-36.23.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): libsndfile-1.0.25-36.23.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): libsndfile-1.0.25-36.23.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): libsndfile-1.0.25-36.23.1 SUSE Linux Enterprise Server 12-SP5 (src): libsndfile-1.0.25-36.23.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): libsndfile-1.0.25-36.23.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): libsndfile-1.0.25-36.23.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): libsndfile-1.0.25-36.23.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): libsndfile-1.0.25-36.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:2764-1: An update that fixes four vulnerabilities is now available. Category: security (critical) Bug References: 1100167,1116993,1117954,1188540 CVE References: CVE-2018-13139,CVE-2018-19432,CVE-2018-19758,CVE-2021-3246 JIRA References: Sources used: SUSE Manager Server 4.0 (src): libsndfile-1.0.28-5.12.1 SUSE Manager Retail Branch Server 4.0 (src): libsndfile-1.0.28-5.12.1 SUSE Manager Proxy 4.0 (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Server for SAP 15 (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Server 15-LTSS (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2 (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): libsndfile-1.0.28-5.12.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): libsndfile-1.0.28-5.12.1 SUSE Enterprise Storage 6 (src): libsndfile-1.0.28-5.12.1 SUSE CaaS Platform 4.0 (src): libsndfile-1.0.28-5.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:2764-1: An update that fixes four vulnerabilities is now available. Category: security (critical) Bug References: 1100167,1116993,1117954,1188540 CVE References: CVE-2018-13139,CVE-2018-19432,CVE-2018-19758,CVE-2021-3246 JIRA References: Sources used: openSUSE Leap 15.3 (src): libsndfile-1.0.28-5.12.1, libsndfile-progs-1.0.28-5.12.1
openSUSE-SU-2021:1166-1: An update that fixes four vulnerabilities is now available. Category: security (critical) Bug References: 1100167,1116993,1117954,1188540 CVE References: CVE-2018-13139,CVE-2018-19432,CVE-2018-19758,CVE-2021-3246 JIRA References: Sources used: openSUSE Leap 15.2 (src): libsndfile-1.0.28-lp152.6.3.1, libsndfile-progs-1.0.28-lp152.6.3.1