Security update for libmysofa SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0459-1 Final 1 1 2021-03-21T23:09:29Z current 2021-03-21T23:09:29Z 2021-03-21T23:09:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libmysofa This update for libmysofa fixes the following issues: - Added security backports: gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977 gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981 gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980 gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978 gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979 gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883 Update to version 0.9.1 * Extended angular neighbor search to 'close the sphere' * Added and exposed mysofa_getfilter_float_nointerp method * Fixed various security issues CVE-2019-16091 - boo#1149919 CVE-2019-16092 - boo#1149920 CVE-2019-16093 - boo#1149922 CVE-2019-16094 - boo#1149924 CVE-2019-16095 - boo#1149926 CVE-2019-20016 - boo#1159839 CVE-2019-20063 - boo#1160040 This update was imported from the openSUSE:Leap:15.2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-459 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ E-Mail link for openSUSE-SU-2021:0459-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1149919 SUSE Bug 1149919 https://bugzilla.suse.com/1149920 SUSE Bug 1149920 https://bugzilla.suse.com/1149922 SUSE Bug 1149922 https://bugzilla.suse.com/1149924 SUSE Bug 1149924 https://bugzilla.suse.com/1149926 SUSE Bug 1149926 https://bugzilla.suse.com/1159839 SUSE Bug 1159839 https://bugzilla.suse.com/1160040 SUSE Bug 1160040 https://bugzilla.suse.com/1181977 SUSE Bug 1181977 https://bugzilla.suse.com/1181978 SUSE Bug 1181978 https://bugzilla.suse.com/1181979 SUSE Bug 1181979 https://bugzilla.suse.com/1181980 SUSE Bug 1181980 https://bugzilla.suse.com/1181981 SUSE Bug 1181981 https://bugzilla.suse.com/1182883 SUSE Bug 1182883 https://www.suse.com/security/cve/CVE-2019-16091/ SUSE CVE CVE-2019-16091 page https://www.suse.com/security/cve/CVE-2019-16092/ SUSE CVE CVE-2019-16092 page https://www.suse.com/security/cve/CVE-2019-16093/ SUSE CVE CVE-2019-16093 page https://www.suse.com/security/cve/CVE-2019-16094/ SUSE CVE CVE-2019-16094 page https://www.suse.com/security/cve/CVE-2019-16095/ SUSE CVE CVE-2019-16095 page https://www.suse.com/security/cve/CVE-2019-20016/ SUSE CVE CVE-2019-20016 page https://www.suse.com/security/cve/CVE-2019-20063/ SUSE CVE CVE-2019-20063 page https://www.suse.com/security/cve/CVE-2020-36148/ SUSE CVE CVE-2020-36148 page https://www.suse.com/security/cve/CVE-2020-36149/ SUSE CVE CVE-2020-36149 page https://www.suse.com/security/cve/CVE-2020-36150/ SUSE CVE CVE-2020-36150 page https://www.suse.com/security/cve/CVE-2020-36151/ SUSE CVE CVE-2020-36151 page https://www.suse.com/security/cve/CVE-2020-36152/ SUSE CVE CVE-2020-36152 page https://www.suse.com/security/cve/CVE-2020-6860/ SUSE CVE CVE-2020-6860 page SUSE Package Hub 15 SP2 libmysofa-devel-0.9.1-bp152.4.3.1 libmysofa0-0.9.1-bp152.4.3.1 libmysofa0-64bit-0.9.1-bp152.4.3.1 libmysofa-devel-0.9.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 libmysofa0-0.9.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 libmysofa0-64bit-0.9.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 Symonics libmysofa 0.7 has an out-of-bounds read in directblockRead in hdf/fractalhead.c. CVE-2019-16091 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2019-16091.html CVE-2019-16091 https://bugzilla.suse.com/1149919 SUSE Bug 1149919 Symonics libmysofa 0.7 has a NULL pointer dereference in getHrtf in hrtf/reader.c. CVE-2019-16092 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2019-16092.html CVE-2019-16092 https://bugzilla.suse.com/1149920 SUSE Bug 1149920 Symonics libmysofa 0.7 has an invalid write in readOHDRHeaderMessageDataLayout in hdf/dataobject.c. CVE-2019-16093 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2019-16093.html CVE-2019-16093 https://bugzilla.suse.com/1149922 SUSE Bug 1149922 Symonics libmysofa 0.7 has an invalid read in readOHDRHeaderMessageDataLayout in hdf/dataobject.c. CVE-2019-16094 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2019-16094.html CVE-2019-16094 https://bugzilla.suse.com/1149924 SUSE Bug 1149924 Symonics libmysofa 0.7 has an invalid read in getDimension in hrtf/reader.c. CVE-2019-16095 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2019-16095.html CVE-2019-16095 https://bugzilla.suse.com/1149926 SUSE Bug 1149926 libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue. CVE-2019-20016 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2019-20016.html CVE-2019-20016 https://bugzilla.suse.com/1159839 SUSE Bug 1159839 hdf/dataobject.c in libmysofa before 0.8 has an uninitialized use of memory, as demonstrated by mysofa2json. CVE-2019-20063 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2019-20063.html CVE-2019-20063 https://bugzilla.suse.com/1160040 SUSE Bug 1160040 Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments). CVE-2020-36148 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2020-36148.html CVE-2020-36148 https://bugzilla.suse.com/1181981 SUSE Bug 1181981 Incorrect handling of input data in changeAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments). CVE-2020-36149 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2020-36149.html CVE-2020-36149 https://bugzilla.suse.com/1181980 SUSE Bug 1181980 Incorrect handling of input data in loudness function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and access to unallocated memory block. CVE-2020-36150 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2020-36150.html CVE-2020-36150 https://bugzilla.suse.com/1181979 SUSE Bug 1181979 Incorrect handling of input data in mysofa_resampler_reset_mem function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and overwriting large memory block. CVE-2020-36151 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2020-36151.html CVE-2020-36151 https://bugzilla.suse.com/1181978 SUSE Bug 1181978 Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA. CVE-2020-36152 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2020-36152.html CVE-2020-36152 https://bugzilla.suse.com/1181977 SUSE Bug 1181977 libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header message attribute. CVE-2020-6860 SUSE Package Hub 15 SP2:libmysofa-devel-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-0.9.1-bp152.4.3.1 SUSE Package Hub 15 SP2:libmysofa0-64bit-0.9.1-bp152.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/ https://www.suse.com/security/cve/CVE-2020-6860.html CVE-2020-6860 https://bugzilla.suse.com/1182883 SUSE Bug 1182883