Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3270-1

Опубликовано: 27 июл. 2026
Источник: suse-cvrf

Описание

Security update for alsa

This update for alsa fixes the following issue

  • CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory (bsc#1268853).

Список пакетов

Container bci/openjdk-devel:17
libasound2-1.2.10-150600.4.3.1
Container bci/openjdk-devel:21
libasound2-1.2.10-150600.4.3.1
Container bci/openjdk-devel:latest
libasound2-1.2.10-150600.4.3.1
Container bci/openjdk:17
libasound2-1.2.10-150600.4.3.1
Container bci/openjdk:21
libasound2-1.2.10-150600.4.3.1
Container bci/openjdk:latest
libasound2-1.2.10-150600.4.3.1
Container suse/kiosk/firefox-esr:latest
libasound2-1.2.10-150600.4.3.1
Container suse/kiosk/pulseaudio:latest
libasound2-1.2.10-150600.4.3.1
Container suse/kiosk/tigervnc-x11vnc:latest
alsa-1.2.10-150600.4.3.1
libasound2-1.2.10-150600.4.3.1
libatopology2-1.2.10-150600.4.3.1
Container suse/kiosk/xorg:latest
alsa-1.2.10-150600.4.3.1
libasound2-1.2.10-150600.4.3.1
libatopology2-1.2.10-150600.4.3.1
SUSE Linux Enterprise Module for Basesystem 15 SP7
alsa-1.2.10-150600.4.3.1
alsa-devel-1.2.10-150600.4.3.1
libasound2-1.2.10-150600.4.3.1
libasound2-32bit-1.2.10-150600.4.3.1
libatopology2-1.2.10-150600.4.3.1

Ссылки

Описание

The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.

Затронутые продукты
Container bci/openjdk-devel:17:libasound2-1.2.10-150600.4.3.1
Container bci/openjdk-devel:21:libasound2-1.2.10-150600.4.3.1
Container bci/openjdk-devel:latest:libasound2-1.2.10-150600.4.3.1
Container bci/openjdk:17:libasound2-1.2.10-150600.4.3.1
Ссылки