summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libvorbis/libvorbis
AgeCommit message (Collapse)Author
2020-07-12libvorbis: upgrade 1.3.6 -> 1.3.7Wang Mingyu
CVE-2017-14160.patch CVE-2018-10392.patch removed since they are included in 1.3.7 -License-Update: Copyright year updated to 2020. license text: URL of Xiph.Org Foundation changed to https://xiph.org/ Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-16libvorbis: 3 CVE fixesJoe Slater
CVE-2017-14160, CVE-2018-10393 (same as 14160), and CVE-2018-10392. These fixes should be in libvorbis 1.3.7. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-05-29libvorbis: 1.3.5 -> 1.3.6Tanu Kaskinen
Rebased 0001-configure-Check-for-clang.patch. Removed the backported CVE patches. License-Update: copyright years refreshed Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-25libvorbis: CVE-2018-5146Tanu Kaskinen
Prevent out-of-bounds write in codebook decoding. The bug could allow code execution from a specially crafted Ogg Vorbis file. References: https://www.debian.org/security/2018/dsa-4140 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146 Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-25libvorbis: CVE-2017-14632Tanu Kaskinen
Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14632 Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-25libvorbis: CVE-2017-14633Tanu Kaskinen
In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14633 Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-23libvorbis: Contain gcc specific compiler flags using configure optionKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-19 07:42:50 +0000