[ GLSA 202107-34 ] FluidSynth

[GLSA]

Gentoo Linux Security Advisory

Title: FluidSynth: Remote code execution (GLSA 202107-34)
Severity: normal
Exploitable: remote
Date: 2021-07-15
Bug(s): #782700
ID: 202107-34

Synopsis

A vulnerability was found in FluidSynth that could result in remote
code execution.


Background

FluidSynth is a real-time synthesizer based on the Soundfont 2
specifications.


Affected Packages

Package: media-sound/fluidsynth
Vulnerable: < 2.2.0
Unaffected: >= 2.2.0
Architectures: All supported architectures


Description

FluidSynth contains a use-after-free in sfloader/fluid_sffile.c which
occurs when parsing Soundfile 2 files.


Impact

A remote attacker could entice a user to open a specially crafted
Soundfont 2 file using FluidSynth, possibly resulting in execution of
arbitrary code with the privileges of the process or a Denial of Service
condition.


Workaround

There is no known workaround at this time.

Resolution

All FluidSynth users should upgrade to the latest version: