Skip to content
OpenAdvisories
Medium ALAS2023-2023-028 1 CVE

Moderate: libsndfile security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-4156: An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 libsndfile 0:1.0.31-6.amzn2023.0.2
Amazon Linux · 2023 libsndfile-debuginfo 0:1.0.31-6.amzn2023.0.2
Amazon Linux · 2023 libsndfile-debugsource 0:1.0.31-6.amzn2023.0.2
Amazon Linux · 2023 libsndfile-devel 0:1.0.31-6.amzn2023.0.2
Amazon Linux · 2023 libsndfile-utils 0:1.0.31-6.amzn2023.0.2
Amazon Linux · 2023 libsndfile-utils-debuginfo 0:1.0.31-6.amzn2023.0.2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-4156.html