Описание
Security update for alsa
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory (bsc#1268853).
Список пакетов
openSUSE Leap 16.0
alsa-1.2.14-160000.3.1
alsa-devel-1.2.14-160000.3.1
alsa-docs-1.2.14-160000.3.1
alsa-topology-devel-1.2.14-160000.3.1
libasound2-1.2.14-160000.3.1
libatopology2-1.2.14-160000.3.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1268853
- SUSE CVE CVE-2026-56109 page
Описание
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
Затронутые продукты
openSUSE Leap 16.0:alsa-1.2.14-160000.3.1
openSUSE Leap 16.0:alsa-devel-1.2.14-160000.3.1
openSUSE Leap 16.0:alsa-docs-1.2.14-160000.3.1
openSUSE Leap 16.0:alsa-topology-devel-1.2.14-160000.3.1
Ссылки
- CVE-2026-56109
- SUSE Bug 1268853