| Name | CVE-2017-7697 |
| Description | In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2845-1, ELA-527-1 |
| Debian Bugs | 860159 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libsamplerate (PTS) | jessie, jessie (lts) | 0.1.8-8+deb8u1 | fixed |
| stretch (security), stretch (lts), stretch | 0.1.8-8+deb9u1 | fixed |
| buster | 0.1.9-2 | fixed |
| bullseye | 0.2.1+ds0-1 | fixed |
| bookworm | 0.2.2-3 | fixed |
| sid, trixie | 0.2.2-4 | fixed |
The information below is based on the following data on fixed versions.
Notes
[jessie] - libsamplerate <no-dsa> (Minor issue)
[wheezy] - libsamplerate <no-dsa> (Minor issue)
https://github.com/erikd/libsamplerate/issues/11
https://blogs.gentoo.org/ago/2017/04/11/libsamplerate-global-buffer-overflow-in-calc_output_single-src_sinc-c/
Fixed by: https://github.com/erikd/libsamplerate/commit/c3b66186656de44da18b7058aec099dbe782dd0b