Gentoo Linux Security Advisory

Title: FluidSynth: Remote code execution ([glsa=202107-34]GLSA 202107-34[/glsa])
Severity: normal
Exploitable: remote
Date: 2021年07月15日
Bug(s): #782700
ID: 202107-34

Synopsis

A vulnerability was found in FluidSynth that could result in remote
code execution.


Background

FluidSynth is a real-time synthesizer based on the Soundfont 2
specifications.


Affected Packages

Package: media-sound/fluidsynth
Vulnerable: < 2.2.0
Unaffected: >= 2.2.0
Architectures: All supported architectures


Description

FluidSynth contains a use-after-free in sfloader/fluid_sffile.c which
occurs when parsing Soundfile 2 files.


Impact

A remote attacker could entice a user to open a specially crafted
Soundfont 2 file using FluidSynth, possibly resulting in execution of
arbitrary code with the privileges of the process or a Denial of Service
condition.


Workaround

There is no known workaround at this time.

Resolution

All FluidSynth users should upgrade to the latest version:

References

CVE-2021-28421

Last edited by GLSA on Sat Jan 22, 2022 5:03 am, edited 2 times in total.