Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3246: A heap buffer overflow flaw was found in libsndfile. This flaw allows an attacker to execute arbitrary code via a crafted WAV file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1984319: CVE-2021-3246 libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libsndfile | 0:1.0.25-12.amzn2.1 |
| Amazon Linux · 2 | libsndfile-debuginfo | 0:1.0.25-12.amzn2.1 |
| Amazon Linux · 2 | libsndfile-devel | 0:1.0.25-12.amzn2.1 |
| Amazon Linux · 2 | libsndfile-utils | 0:1.0.25-12.amzn2.1 |
Vulnerabilities 1
-
Unscored —
A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-3246.html