libvorbis 1.2.0.dfsg-3.1ubuntu0.8.10.2 source package in Ubuntu

Changelog

libvorbis (1.2.0.dfsg-3.1ubuntu0.8.10.2) intrepid-security; urgency=low

  * SECURITY UPDATE: denial of service and possible code execution via
    multiple vulnerabilities
    - debian/patches/CVE-2009-3379.patch: Don't try to read past the end of
      the comment packet if the string lengths are corrupt in lib/info.c,
      check for premature EOP in lib/res0.c, implement hardening in
      lib/{codebook,floor1,info,mapping0}.c, eliminate blocklist overflow
      in lib/backends.h, don't allow codeword lengths longer than 32 bits
      in lib/codebook.c.
    - CVE-2009-3379
  * SECURITY UPDATE: denial of service via underpopulated Huffman trees
    - debian/patches/upstream-r14811_huffman_sanity_checks.diff: add
      additional checking to the hufftree decoding in lib/block.c,
      examples/decoder_example.c, lib/sharedbook.c.
    - CVE-2008-2009
  * SECURITY UPDATE: code execution via heap overflow in residue partition
    value (LP: #232150)
    - debian/patches/CVE-2008-1420-2.patch: add additional checks to fix
      issue, but still maintain backwards compatibility in lib/res0.c,
      lib/modes/{residue_44u,residue_44}.h, lib/backends.h.
    - CVE-2008-1420
 -- Marc Deslauriers <email address hidden>   Fri, 13 Nov 2009 09:42:51 -0500