Hi, The following vulnerabilities were published for libgig. See: https://github.com/TeamSeri0us/pocs/blob/master/libgig/README.md https://github.com/TeamSeri0us/pocs/blob/master/libgig/README-1008.md for the initial report and reproducers. As far as I can see, there was no discussion yet with you (package maintainers), nor with upstream, so I'm opening this bug to clarify their status. CVE-2018-14449[0]: | An issue was discovered in libgig 4.1.0. There is an out of bounds | read in gig::File::UpdateChunks in gig.cpp. CVE-2018-14450[1]: | An issue was discovered in libgig 4.1.0. There is an out-of-bounds | read in the "update dimension region's chunks" feature of the function | gig::Region::UpdateChunks in gig.cpp. CVE-2018-14451[2]: | An issue was discovered in libgig 4.1.0. There is a heap-based buffer | overflow in the function RIFF::Chunk::Read in RIFF.cpp. CVE-2018-14452[3]: | An issue was discovered in libgig 4.1.0. There is an out-of-bounds | read in the "always assign the sample of the first dimension region of | this region" feature of the function gig::Region::UpdateChunks in | gig.cpp. CVE-2018-14453[4]: | An issue was discovered in libgig 4.1.0. There is a heap-based buffer | overflow in pData[1] access in the function store16 in helper.h. CVE-2018-14454[5]: | An issue was discovered in libgig 4.1.0. There is an out-of-bounds | read in the function RIFF::Chunk::Read in RIFF.cpp. CVE-2018-14455[6]: | An issue was discovered in libgig 4.1.0. There is an out-of-bounds | write in pData[0] access in the function store32 in helper.h. CVE-2018-14456[7]: | An issue was discovered in libgig 4.1.0. There is an out-of-bounds | write in the function DLS::Info::SaveString in DLS.cpp. CVE-2018-14457[8]: | An issue was discovered in libgig 4.1.0. There is an out-of-bounds | write in the function DLS::Info::UpdateChunks in DLS.cpp. CVE-2018-14458[9]: | An issue was discovered in libgig 4.1.0. There is a heap-based buffer | overflow in pData[1] access in the function store32 in helper.h. CVE-2018-14459[10]: | An issue was discovered in libgig 4.1.0. There is an out-of-bounds | write in pData[0] access in the function store16 in helper.h. CVE-2018-14460[11]: | An issue was discovered in the HDF HDF5 1.8.20 library. There is a | heap-based buffer over-read in the function H5O_sdspace_decode in | H5Osdspace.c. CVE-2018-18192[12]: | An issue was discovered in libgig 4.1.0. There is a NULL pointer | dereference in the function DLS::File::GetFirstSample() in DLS.cpp. CVE-2018-18193[13]: | An issue was discovered in libgig 4.1.0. There is operator new[] | failure (due to a big pWavePoolTable heap request) in DLS::File::File | in DLS.cpp. CVE-2018-18194[14]: | An issue was discovered in libgig 4.1.0. There is a heap-based buffer | over-read in DLS::Region::GetSample() in DLS.cpp. CVE-2018-18195[15]: | An issue was discovered in libgig 4.1.0. There is an FPE (divide-by- | zero error) in DLS::Sample::Sample in DLS.cpp. CVE-2018-18196[16]: | An issue was discovered in libgig 4.1.0. There is a heap-based buffer | over-read in RIFF::List::GetListTypeString in RIFF.cpp. CVE-2018-18197[17]: | An issue was discovered in libgig 4.1.0. There is an operator new[] | failure (due to a big pSampleLoops heap request) in | DLS::Sampler::Sampler in DLS.cpp. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2018-14449 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14449 [1] https://security-tracker.debian.org/tracker/CVE-2018-14450 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14450 [2] https://security-tracker.debian.org/tracker/CVE-2018-14451 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14451 [3] https://security-tracker.debian.org/tracker/CVE-2018-14452 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14452 [4] https://security-tracker.debian.org/tracker/CVE-2018-14453 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14453 [5] https://security-tracker.debian.org/tracker/CVE-2018-14454 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14454 [6] https://security-tracker.debian.org/tracker/CVE-2018-14455 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14455 [7] https://security-tracker.debian.org/tracker/CVE-2018-14456 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14456 [8] https://security-tracker.debian.org/tracker/CVE-2018-14457 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14457 [9] https://security-tracker.debian.org/tracker/CVE-2018-14458 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14458 [10] https://security-tracker.debian.org/tracker/CVE-2018-14459 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14459 [11] https://security-tracker.debian.org/tracker/CVE-2018-14460 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14460 [12] https://security-tracker.debian.org/tracker/CVE-2018-18192 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18192 [13] https://security-tracker.debian.org/tracker/CVE-2018-18193 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18193 [14] https://security-tracker.debian.org/tracker/CVE-2018-18194 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18194 [15] https://security-tracker.debian.org/tracker/CVE-2018-18195 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18195 [16] https://security-tracker.debian.org/tracker/CVE-2018-18196 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18196 [17] https://security-tracker.debian.org/tracker/CVE-2018-18197 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18197 Please adjust the affected versions in the BTS as needed. Cheers! Sylvain Beucler, Debian LTS team
retitle 931309 libgig: Multiple security issues (CVE-2018-14449..14459, CVE-2018-18192..18197) thanks (typo: not CVE-2018-14460)
Hello libgig maintainers and security team, I have verified that all CVE still affect the latest version in Debian. Most of them just lead to a denial of service (application crash). CVE-2018-18193 leads to memory exhaustion and almost completely freezes the system. The heap-based buffer overflows may have a more serious impact depending on the situation. The upstream maintainer of libgig, Christian Schoenebeck (CCed), was not aware of them. In a private conversation Christian stated that "The file types I mentioned above are always consciously, manually opened by users (all in pro-audio context) with these applications, and (except of .sf2 probably) are rather quite exotic file formats from an average user's point of view. Most of our users either create those files by themselves with our tools (e.g. with gigedit and/or gigtools) or they are loading files from commercial sample library CDs dating back between mid 1980s - mid 2000s (libgig started in 2003), and yet some users share their files with close/trusted persons. In short: the chance that somebody successfully attempts to use these file types for security exploits that would really harm somebody seriously in reality, is quite low." I have the same impression and the risk of being affected by one of these vulnerabilities is low because of the special file format and how those files are created. libgig was not designed to be secure and to process untrusted files. Christian asked me that we should notify users about the situation, to open only trusted files or in a sandboxed environment, and I suggested to add a README.Debian file to libgig for clarification. I hereby forward this request to the maintainers of libgig. I have come to the conclusion that we won't spend time on fixing these issues in Jessie because of the low security risk. Fixing those bugs is not a development priority of upstream currently and Christian asked for help and patches. Regards, Markus