Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.2096 taglib - security update 19 July 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: taglib Publisher: Debian Operating System: Debian GNU/Linux 8 UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Access Confidential Data -- Existing Account Denial of Service -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2018-11439 Original Bulletin: https://security-tracker.debian.org/tracker/DLA-1430-1 Comment: This advisory references vulnerabilities in products which run on platforms other than Debian. It is recommended that administrators running taglib check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Package : taglib Version : 1.9.1-2.1+deb8u1 CVE ID : CVE-2018-11439 CVE-2018-11439 Fix for a heap-based buffer over-read via a crafted audio file. For Debian 8 "Jessie", these problems have been fixed in version 1.9.1-2.1+deb8u1. We recommend that you upgrade your taglib packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQJ8BAEBCgBmBQJbT55CXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ2MjAxRkJGRkRCQkRFMDc4MjJFQUJCOTY5 NkZDQUMwRDM4N0I1ODQ3AAoJEJb8rA04e1hHJDMP/A0vk+WD8TTdWxi8rxzVj8fR z9e7IqGECRUy79X/u7NbNrJm+6EOdwfZgSctYOFvgZROMzK6PTdBTAgJor7cp1Kl hHmKgDls8sG72XjEJa3/6RRcM27vbqViLqi3zgELhBvEPZ7vTvKlXeNCdiPgp8aK ee5dFDKAJJQqvFYzSF4X0Sw5qDGHYUQJFfRxl5lhlMaQMTBidgAaRR26PfkeEQ3q djSTtIsKyH9Obpc/4Arvbh8i/ifBK/daorf8Jg86bmxWAI+xuJ000tzG9wA9FVO4 u2Er9AAt+oo3o3CjcZ4wmiGncc1AzgWVVEqA7RnJKK7Q4FnLZ+4IGB4FUCmlwXYw 9Us1f3r1JwLfQNlCJe/CvT8E7oFgTNjFCxD1uAccVNq0aNXCwXky5jTMjaIpCJXW 45qIMc5ndwQoJn5wmMiJcsciynt8XnhHclI6l6Z9IGFyQhqxStXPcidpsAW+7ATW N9wRCnV149gg1NSvEG5s4OXGV+CfBvH9ZH7RYACUAqXCFxoDGMs2JIouLlKaSiAR mZ+TPGwtxeZxLkF2I1FPvYPX9PF125vOSNo+8q95fnEEGGtGcU+EuaHflRC8cezc nF8P4XCXslyG07GL1Os0u7e2pmkCsd8syghanq01INvv/b5W8rVlfTX2GwQY4Go4 mdr6NfXhZOU1JdVgjPE4 =IlOz - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW1AGGmaOgq3Tt24GAQgCtw//YBwovAQ3OD6C3NhxCQeSSE/A+Y4ztTVa 6VZWLtCTh5Vi3g+a2sjZpTwDfWWR4E1b4rEQlyyMbaYLwjmli8xzXqH3TYJ0uyP8 sYgknLvpbJs1zgUiylaU5+gPtxmXNGDJOId3NxmcBMm9fSHV8gkAF2zR7Bud04vn Ij9X1Abumy89SA3xl+inNxOi+pE3Q8C1jxGE3tg4Ma8R0IGptMjlY9Z/nF7Xag6F IF7/jh1cr3kEuHOGSo+OfxfDS6j5Vw8WMX6+ZPTnuxplsa10yZKAZ7gr64eA7QNI tl3fTYvUs9JylLlcEH96ZO6y01QTiR+UGjF6Rb0XwzzVNFB90KQ/nyLv/XGzn4Xn 322D+LqeAGsKpJVk3Z+ifV5KUNlX9U2XnDKLbohXZ1rIT0QFL+F0yE+CIcPyrRlm UCvdUJ4gYOmc1+d257TvQSOd7ZlLYcCAQVlSO/DIksXoDmT+s+CBVBU9/O5rGZda pXr+OADNeB1siKFb/GpDAaK8Ve3+RZ9jU0NUSLOBOOe5Hv9fZ80a8ADT9CBsJBzs +iAndYezsPwZtoPUI57U9Cmhz//WvWnxcQgXYVdtKjfHyk/vK5034KUAxdNJPFzs dVEAd/9cSppU9duf1u3hpCcdlW9+qhXHbpf/wO8JDZFiL5cAsjVg4JgryoQ6stB3 JDoTWxbTLOU= =8wkx -----END PGP SIGNATURE-----