Описание
[Heap Buffer Overflow in GNOME localsearch MP3 Extractor (ID3v2.3 COMM Tags)]
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| localsearch | fixed | 3.8.2-12 | package | |
| tracker-miners | removed | package | ||
| tracker-miners | no-dsa | trixie | package | |
| tracker-miners | no-dsa | bookworm | package | |
| tracker-miners | postponed | bullseye | package |
Примечания
https://gitlab.gnome.org/GNOME/localsearch/-/issues/428
Fixed by: https://gitlab.gnome.org/GNOME/localsearch/-/commit/9cc562cc126c408efb2a8220fcd67f006902412c
Связанные уязвимости
[Heap Buffer Overflow in GNOME localsearch MP3 Extractor (ID3v2.3 COMM Tags)]
A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.
