USN-4079-2: SoX vulnerabilities

1 August 2019

SoX could be made to crash if it received a specially crafted MP3 file.

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Releases

USN-4079-1 fixed vulnerabilities in SoX. This update provides the corresponding
update for Ubuntu 18.04 LTS and Ubuntu 19.04.

Original advisory details:

It was discovered that SoX incorrectly handled certain MP3 files. An attacker
could possibly use this issue to cause a denial of service. (CVE-2019-8354,
CVE-2019-8355, CVE-2019-8356, CVE-2019-8357)

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

The problem can be corrected by updating your system to the following package versions:

In general, a standard system update will make all the necessary changes.

USN-4079-1: libsox2, libsox-fmt-ao, libsox-fmt-all, sox, libsox-fmt-mp3, libsox-dev, libsox-fmt-alsa, libsox-fmt-pulse, libsox-fmt-oss, libsox-fmt-base

Ubuntu Pro provides up to ten-year security coverage for over 23,000 open-source packages within the Ubuntu Main and Universe repositories.