Skip to content
OpenAdvisories
Medium ALAS2-2023-1998 1 CVE

Moderate: libsndfile security update (Amazon Linux 2)

Published Mar 17, 2023 · Updated Mar 21, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-4156: An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 libsndfile 0:1.0.25-12.amzn2.2
Amazon Linux · 2 libsndfile-debuginfo 0:1.0.25-12.amzn2.2
Amazon Linux · 2 libsndfile-devel 0:1.0.25-12.amzn2.2
Amazon Linux · 2 libsndfile-utils 0:1.0.25-12.amzn2.2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-4156.html