bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.

- spec cleanup, silent rpmlint

  - remove upstreamed patches, fixes rhbz #1507577

  - update to 1.2.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mitre reports :

bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.

Wen Bin discovered that bchunk, an application that converts a CD image in bin/cue format into a set of iso and cdr/wav tracks files, did not properly check its input. This would allow malicious users to crash the application or potentially execute arbitrary code.

Several vulnerabilities were discovered in bchunk, a tool to convert a CD image in .bin/.cue format into a set of .iso and .cdr/.wav tracks.
It was possible to trigger a heap-based buffer overflow with an resultant invalid free when processing a malformed CUE (.cue) file that may lead to the execution of arbitrary code or a application crash.

For Debian 7 'Wheezy', these problems have been fixed in version 1.2.0-12+deb7u1.

We recommend that you upgrade your bchunk packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
120465	Fedora 28 : bchunk (2018-60ec960104)	Nessus	Fedora Local Security Checks	medium
108918	Fedora 26 : bchunk (2018-d5aa3e1d90)	Nessus	Fedora Local Security Checks	medium
108908	Fedora 27 : bchunk (2018-1217b02061)	Nessus	Fedora Local Security Checks	medium
106810	FreeBSD : bchunk -- heap-based buffer overflow and crash (1ec1c59b-0e98-11e8-83e7-485b3931c969)	Nessus	FreeBSD Local Security Checks	medium
104482	Debian DSA-4026-1 : bchunk - security update	Nessus	Debian Local Security Checks	medium
104364	Debian DLA-1158-1 : bchunk security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-15953

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium