Monthly Archives: January 2017

libmp3splt: NULL pointer dereference in splt_cue_export_to_file (cue.c)

Posted on January 29, 2017 by ago

Description: libmp3splt a library for mp3splt to split mp3 and ogg files without decoding. A fuzz on it discovered a NULL pointer access. The complete ASan output: # mp3splt -P -f -t 0.1 -a $FILE ==2581==ERROR: AddressSanitizer: SEGV on unknown … Continue reading →

Posted in advisories, security | 1 Comment

mp3splt: invalid free in free_options (options_manager.c)

Posted on January 29, 2017 by ago

Description: mp3splt is a command line utility to split mp3 and ogg files without decoding. A fuzz on it discovered an invalid free. The complete ASan output: # mp3splt -P -f -t 0.1 -a $FILE ==2631==ERROR: AddressSanitizer: attempting free on … Continue reading →

Posted in advisories, security | 16 Comments

mp3splt: NULL pointer dereference in main (mp3splt.c)

Posted on January 29, 2017 by ago

Description: mp3splt is a command line utility to split mp3 and ogg files without decoding. A fuzz on it discovered a NULL pointer access. The complete ASan output: # mp3splt -P -f -t 0.1 -a $FILE ==3081==ERROR: AddressSanitizer: SEGV on … Continue reading →

Posted in advisories, security | Leave a comment

jasper: heap-based buffer overflow in jpc_dec_decodepkt (jpc_t2dec.c)

Posted on January 25, 2017 by ago

Description: jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Another round of fuzzing shows that a crafted image causes a read overflow. The complete ASan output: # … Continue reading →

Posted in advisories, security | Leave a comment

jasper: invalid memory read in jas_matrix_bindsub (jas_seq.c)

Posted on January 25, 2017 by ago

Description: jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Another round of fuzzing shows that a crafted image causes an invalid memory read. The complete ASan output: … Continue reading →

Posted in advisories, security | Leave a comment

jasper: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)

Posted on January 25, 2017 by ago

Description: jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Another round of fuzzing shows that a crafted image causes a NULL pointer access. The complete ASan output: … Continue reading →

Posted in advisories, security | Leave a comment

<sys-libs/zlib-1.2.11 – possible data corruption

Posted on January 16, 2017 by ago

I don’t know if a news will be sent. A possibile data corruption was found on zlib 1.2.10. Please update your zlib to 1.2.11 and make sure you restart all services that are linked to zlib (a reboot may be … Continue reading →

Posted in gentoo | Leave a comment

jasper: invalid memory read in jas_matrix_asl (jas_seq.c)

Posted on January 16, 2017 by ago

Description: jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Another round of fuzzing shows that a crafted image causes an invalid memory read. The complete ASan output: … Continue reading →

Posted in advisories, security | Leave a comment

jasper: invalid memory read in jpc_undo_roi (jpc_dec.c)

Posted on January 16, 2017 by ago

Description: jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Another round of fuzzing shows that a crafted image causes an invalid memory read. The complete ASan output: … Continue reading →

Posted in advisories, security | 1 Comment

jasper: invalid memory write in dec_clnpass (jpc_t1dec.c)

Posted on January 16, 2017 by ago

Description: jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Another round of fuzzing shows that a crafted image causes an invalid memory write. The complete ASan output: … Continue reading →

Posted in advisories, security | 2 Comments