CVE-2017-15019

LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call.

LAME 3.100 has been released including fixes to security vulnerabilities. Note the MP3 patents have expired.

This update for lame fixes the following issues:

Lame was updated to version 3.100:

• Improved detection of MPEG audio data in RIFF WAVE files. sf#3545112 Invalid sampling detection
• New switch --gain <decibel>, range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the use of --scale <factor>.
• Fix for sf#3558466 Bug in path handling
• Fix for sf#3567844 problem with Tag genre
• Fix for sf#3565659 no progress indication with pipe input
• Fix for sf#3544957 scale (empty) silent encode without warning
• Fix for sf#3580176 environment variable LAMEOPT doesn't work anymore
• Fix for sf#3608583 input file name displayed with wrong character encoding (on windows console with CP_UTF8)
• Fix dereference NULL and Buffer not NULL terminated issues. (CVE-2017-15019 bsc#1082317 CVE-2017-13712 bsc#1082399 CVE-2015-9100 bsc#1082401)
• Fix dereference of a null pointer possible in loop.
• Make sure functions with SSE instructions maintain their own properly aligned stack. Thanks to Fabian Greffrath
• Multiple Stack and Heap Corruptions from Malicious File. (CVE-2017-9872 bsc#1082391 CVE-2017-9871 bsc#1082392 CVE-2017-9870 bsc#1082393 CVE-2017-9869 bsc#1082395 CVE-2017-9411 bsc#1082397 CVE-2015-9101 bsc#1082400)
• CVE-2017-11720: Fix a division by zero vulnerability. (bsc#1082311)
• CVE-2017-9410: Fix fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap (bsc#1082333)
• CVE-2017-9411: Fix fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash (bsc#1082397)
• CVE-2017-9412: FIx unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash (bsc#1082340)
• Fix clip detect scale suggestion unaware of scale input value
• HIP decoder bug fixed: decoding mixed blocks of lower sample frequency Layer3 data resulted in internal buffer overflow.
• Add lame_encode_buffer_interleaved_int()

This update for lame fixes the following issues:

Lame was updated to version 3.100:

• Improved detection of MPEG audio data in RIFF WAVE files. sf#3545112 Invalid sampling detection
• New switch --gain <decibel>, range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the use of --scale <factor>.
• Fix for sf#3558466 Bug in path handling
• Fix for sf#3567844 problem with Tag genre
• Fix for sf#3565659 no progress indication with pipe input
• Fix for sf#3544957 scale (empty) silent encode without warning
• Fix for sf#3580176 environment variable LAMEOPT doesn't work anymore
• Fix for sf#3608583 input file name displayed with wrong character encoding (on windows console with CP_UTF8)
• Fix dereference NULL and Buffer not NULL terminated issues. (CVE-2017-15019 bsc#1082317 CVE-2017-13712 bsc#1082399 CVE-2015-9100 bsc#1082401)
• Fix dereference of a null pointer possible in loop.
• Make sure functions with SSE instructions maintain their own properly aligned stack. Thanks to Fabian Greffrath
• Multiple Stack and Heap Corruptions from Malicious File. (CVE-2017-9872 bsc#1082391 CVE-2017-9871 bsc#1082392 CVE-2017-9870 bsc#1082393 CVE-2017-9869 bsc#1082395 CVE-2017-9411 bsc#1082397 CVE-2015-9101 bsc#1082400)
• CVE-2017-11720: Fix a division by zero vulnerability. (bsc#1082311)
• CVE-2017-9410: Fix fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap (bsc#1082333)
• CVE-2017-9411: Fix fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash (bsc#1082397)
• CVE-2017-9412: FIx unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash (bsc#1082340)
• Fix clip detect scale suggestion unaware of scale input value
• HIP decoder bug fixed: decoding mixed blocks of lower sample frequency Layer3 data resulted in internal buffer overflow.
• Add lame_encode_buffer_interleaved_int()

It was discovered that LAME incorrectly handled certain audio files. A remote attacker could possibly use this issue to cause a denial of service. Eight vulnerabilities (CVE-2015-9099, CVE-2015-9100, CVE-2015-9101, CVE-2017-15018, CVE-2017-11720, CVE-2017-8419, CVE-2017-9412, CVE-2017-15045) only affected Ubuntu 14.04 ESM, two vulnerabilities (CVE-2017-9410 and CVE-2017-9411) only affected Ubuntu 16.04 ESM, and one vulnerability (CVE-2017-15019) affected both Ubuntu 14.04 ESM and Ubuntu 16.04.