Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2096
taglib - security update
19 July 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: taglib
Publisher: Debian
Operating System: Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Access Confidential Data -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2018-11439
Original Bulletin:
https://security-tracker.debian.org/tracker/DLA-1430-1
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running taglib check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Package : taglib
Version : 1.9.1-2.1+deb8u1
CVE ID : CVE-2018-11439
CVE-2018-11439
Fix for a heap-based buffer over-read via a crafted audio file.
For Debian 8 "Jessie", these problems have been fixed in version
1.9.1-2.1+deb8u1.
We recommend that you upgrade your taglib packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQJ8BAEBCgBmBQJbT55CXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ2MjAxRkJGRkRCQkRFMDc4MjJFQUJCOTY5
NkZDQUMwRDM4N0I1ODQ3AAoJEJb8rA04e1hHJDMP/A0vk+WD8TTdWxi8rxzVj8fR
z9e7IqGECRUy79X/u7NbNrJm+6EOdwfZgSctYOFvgZROMzK6PTdBTAgJor7cp1Kl
hHmKgDls8sG72XjEJa3/6RRcM27vbqViLqi3zgELhBvEPZ7vTvKlXeNCdiPgp8aK
ee5dFDKAJJQqvFYzSF4X0Sw5qDGHYUQJFfRxl5lhlMaQMTBidgAaRR26PfkeEQ3q
djSTtIsKyH9Obpc/4Arvbh8i/ifBK/daorf8Jg86bmxWAI+xuJ000tzG9wA9FVO4
u2Er9AAt+oo3o3CjcZ4wmiGncc1AzgWVVEqA7RnJKK7Q4FnLZ+4IGB4FUCmlwXYw
9Us1f3r1JwLfQNlCJe/CvT8E7oFgTNjFCxD1uAccVNq0aNXCwXky5jTMjaIpCJXW
45qIMc5ndwQoJn5wmMiJcsciynt8XnhHclI6l6Z9IGFyQhqxStXPcidpsAW+7ATW
N9wRCnV149gg1NSvEG5s4OXGV+CfBvH9ZH7RYACUAqXCFxoDGMs2JIouLlKaSiAR
mZ+TPGwtxeZxLkF2I1FPvYPX9PF125vOSNo+8q95fnEEGGtGcU+EuaHflRC8cezc
nF8P4XCXslyG07GL1Os0u7e2pmkCsd8syghanq01INvv/b5W8rVlfTX2GwQY4Go4
mdr6NfXhZOU1JdVgjPE4
=IlOz
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW1AGGmaOgq3Tt24GAQgCtw//YBwovAQ3OD6C3NhxCQeSSE/A+Y4ztTVa
6VZWLtCTh5Vi3g+a2sjZpTwDfWWR4E1b4rEQlyyMbaYLwjmli8xzXqH3TYJ0uyP8
sYgknLvpbJs1zgUiylaU5+gPtxmXNGDJOId3NxmcBMm9fSHV8gkAF2zR7Bud04vn
Ij9X1Abumy89SA3xl+inNxOi+pE3Q8C1jxGE3tg4Ma8R0IGptMjlY9Z/nF7Xag6F
IF7/jh1cr3kEuHOGSo+OfxfDS6j5Vw8WMX6+ZPTnuxplsa10yZKAZ7gr64eA7QNI
tl3fTYvUs9JylLlcEH96ZO6y01QTiR+UGjF6Rb0XwzzVNFB90KQ/nyLv/XGzn4Xn
322D+LqeAGsKpJVk3Z+ifV5KUNlX9U2XnDKLbohXZ1rIT0QFL+F0yE+CIcPyrRlm
UCvdUJ4gYOmc1+d257TvQSOd7ZlLYcCAQVlSO/DIksXoDmT+s+CBVBU9/O5rGZda
pXr+OADNeB1siKFb/GpDAaK8Ve3+RZ9jU0NUSLOBOOe5Hv9fZ80a8ADT9CBsJBzs
+iAndYezsPwZtoPUI57U9Cmhz//WvWnxcQgXYVdtKjfHyk/vK5034KUAxdNJPFzs
dVEAd/9cSppU9duf1u3hpCcdlW9+qhXHbpf/wO8JDZFiL5cAsjVg4JgryoQ6stB3
JDoTWxbTLOU=
=8wkx
-----END PGP SIGNATURE-----