libsndfile contains an integer overflow condition in the handling of Core Audio Format (CAF) media files. The issue is due to the library not validating user-supplied input. With a specially crafted CAF file containing malformed description chunks, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially execution of arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.0.19, or higher, to address this vulnerability.

• CVE ID: 2009-0186 (see also: NVD)
• Bugtraq ID: 33963
• Secunia Advisory ID: 33980 33981 34316 34526 34642 34791 37538
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2009-03/0027.html
  http://www.securityfocus.com/archive/1/archive/1/501399/100/0/threaded
  http://www.securityfocus.com/archive/1/archive/1/501413/100/0/threaded
• Vendor Specific News/Changelog Entry: http://lists.debian.org/debian-security-announce/2009/msg00052.html
  http://www.mega-nerd.com/libsndfile/NEWS
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2009-March/000875.html
  https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00238.html
  https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00251.html
• Other Advisory URL: http://secunia.com/secunia_research/2009-7/
  http://secunia.com/secunia_research/2009-8/
  http://www.vupen.com/english/advisories/2009/0584
  http://www.vupen.com/english/advisories/2009/0585
• Vendor Specific Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200904-16.xml
  http://www.novell.com/linux/security/advisories/2009_8_sr.html
• Vendor URL: http://www.mega-nerd.com/libsndfile/

• Alin Rad Pop - Secunia Research