MDVSA-2008:094

Nom du paquet

speex

Date

2008-04-29

Advisory ID

MDVSA-2008:094

Affected versions

2008.0 i586 , 2007.1 i586 , CS3.0 x86_64 , 2008.0 x86_64 , CS3.0 i586 , 2008.1 x86_64 , 2008.1 i586 , 2007.1 x86_64

Problem description

A vulnerability in the Speex library was found where it did not
properly validate input values read from the Speex files headers.
An attacker could create a malicious Speex file that would crash an
application or potentially allow the execution of arbitrary code
with the privileges of the application calling the Speex library
(CVE-2008-1686).

The updated packages have been patched to correct this issue.

Updated packages

2008.0 i586

 bf17db7cd95428e63d00f0f4e7165ac9  2008.0/i586/libspeex1-1.2-0.beta2.2mdv2008.0.i586.rpm
 671adc2906555735cadeb85b4af61712  2008.0/i586/libspeex1-devel-1.2-0.beta2.2mdv2008.0.i586.rpm
 d98a4bbf25cd035f57033c1a79ded567  2008.0/i586/libspeex1-static-devel-1.2-0.beta2.2mdv2008.0.i586.rpm
 0033479a6ad6a1f058d003aaaa419e11  2008.0/i586/speex-1.2-0.beta2.2mdv2008.0.i586.rpm 
 54b0117b6ac914f315e8fefd8035b420  2008.0/SRPMS/speex-1.2-0.beta2.2mdv2008.0.src.rpm

2007.1 i586

 9ec171c12ce48baeb891f4067e6f1494  2007.1/i586/libspeex1-1.2-0.beta1.2mdv2007.1.i586.rpm
 6ffc93b5a7c927cc717d9b15019c2233  2007.1/i586/libspeex1-devel-1.2-0.beta1.2mdv2007.1.i586.rpm
 225ec9f3fa996b007c76d15acff6e4f9  2007.1/i586/libspeex1-static-devel-1.2-0.beta1.2mdv2007.1.i586.rpm
 0875fdb13465945d058d3eccd9184bb6  2007.1/i586/speex-1.2-0.beta1.2mdv2007.1.i586.rpm 
 80f2501becaaeaafcd9ce7a1c86472ba  2007.1/SRPMS/speex-1.2-0.beta1.2mdv2007.1.src.rpm

CS3.0 x86_64

 10e405dc6f22dfcc192456a5939b7466  corporate/3.0/x86_64/lib64speex1-1.1.4-1.1.C30mdk.x86_64.rpm
 e605cf181b931b5ab3c02c0e0ca55579  corporate/3.0/x86_64/lib64speex1-devel-1.1.4-1.1.C30mdk.x86_64.rpm
 d7c3241efe4e5430c0d56357247e0940  corporate/3.0/x86_64/lib64speex1-static-devel-1.1.4-1.1.C30mdk.x86_64.rpm
 5b71623854d51f6a3e4eb83908a51b20  corporate/3.0/x86_64/speex-1.1.4-1.1.C30mdk.x86_64.rpm 
 b58c99bdad93b60c464960c4b090fd9b  corporate/3.0/SRPMS/speex-1.1.4-1.1.C30mdk.src.rpm

2008.0 x86_64

 8fcd0a9d267a8eda4e75ac176ad97518  2008.0/x86_64/lib64speex1-1.2-0.beta2.2mdv2008.0.x86_64.rpm
 93eb0cb738993f285fd00ed89d52671c  2008.0/x86_64/lib64speex1-devel-1.2-0.beta2.2mdv2008.0.x86_64.rpm
 54b851b1ec1b80f25751b36cf33dbe8e  2008.0/x86_64/lib64speex1-static-devel-1.2-0.beta2.2mdv2008.0.x86_64.rpm
 ff3b049c0fea0c3554e01b7582e7ddf3  2008.0/x86_64/speex-1.2-0.beta2.2mdv2008.0.x86_64.rpm 
 54b0117b6ac914f315e8fefd8035b420  2008.0/SRPMS/speex-1.2-0.beta2.2mdv2008.0.src.rpm

CS3.0 i586

 0a77e3a79563e49c46e63482b0e3409a  corporate/3.0/i586/libspeex1-1.1.4-1.1.C30mdk.i586.rpm
 db1583859f7e4b21efa7208c94a58f75  corporate/3.0/i586/libspeex1-devel-1.1.4-1.1.C30mdk.i586.rpm
 997beb62819c1ee1389d22401d24f28b  corporate/3.0/i586/libspeex1-static-devel-1.1.4-1.1.C30mdk.i586.rpm
 3a959a4223c5e88d79447d6fbd4ea760  corporate/3.0/i586/speex-1.1.4-1.1.C30mdk.i586.rpm 
 b58c99bdad93b60c464960c4b090fd9b  corporate/3.0/SRPMS/speex-1.1.4-1.1.C30mdk.src.rpm

2008.1 x86_64

 fea13c33015f88e600daa03b5420941b  2008.1/x86_64/lib64speex1-1.2-0.beta3.2mdv2008.1.x86_64.rpm
 a853840d0e1f22fadc957c02a2c9c68a  2008.1/x86_64/lib64speex-devel-1.2-0.beta3.2mdv2008.1.x86_64.rpm
 bc6d744de256ec68d6098198ee4e6e90  2008.1/x86_64/lib64speex-static-devel-1.2-0.beta3.2mdv2008.1.x86_64.rpm
 71ec90ea1d4062faaf5b7876b1c63828  2008.1/x86_64/speex-1.2-0.beta3.2mdv2008.1.x86_64.rpm 
 08d9435f7210eaf8d75bfb91b12417f2  2008.1/SRPMS/speex-1.2-0.beta3.2mdv2008.1.src.rpm

2008.1 i586

 5a5564ba9cd86296cbffcf1dec76a827  2008.1/i586/libspeex1-1.2-0.beta3.2mdv2008.1.i586.rpm
 d0207ca66ea3309ac52b09f1f19f687a  2008.1/i586/libspeex-devel-1.2-0.beta3.2mdv2008.1.i586.rpm
 5c6c38eeff0846fcfcf25157e05ffcbe  2008.1/i586/libspeex-static-devel-1.2-0.beta3.2mdv2008.1.i586.rpm
 e21624f8d3592e26e67444a4370cbeec  2008.1/i586/speex-1.2-0.beta3.2mdv2008.1.i586.rpm 
 08d9435f7210eaf8d75bfb91b12417f2  2008.1/SRPMS/speex-1.2-0.beta3.2mdv2008.1.src.rpm

2007.1 x86_64

 8d2ddd83f9de7fb47e1b603de33dfdfa  2007.1/x86_64/lib64speex1-1.2-0.beta1.2mdv2007.1.x86_64.rpm
 0612ec7a9ed7614c9e95293fbdea3081  2007.1/x86_64/lib64speex1-devel-1.2-0.beta1.2mdv2007.1.x86_64.rpm
 ee67f843225772dc156f574a724a4cad  2007.1/x86_64/lib64speex1-static-devel-1.2-0.beta1.2mdv2007.1.x86_64.rpm
 b9fc3e7eb7ebf52f8360d27880187b57  2007.1/x86_64/speex-1.2-0.beta1.2mdv2007.1.x86_64.rpm 
 80f2501becaaeaafcd9ce7a1c86472ba  2007.1/SRPMS/speex-1.2-0.beta1.2mdv2007.1.src.rpm

References

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1686
• http://www.ocert.org/advisories/ocert-2008-004.html