Updated fluidsynth packages fix a security vulnerability

2021-07-0903:27:08

Gentoo Foundation

advisories.mageia.org

fluidsynth

software synthesizer

soundfont

security vulnerability

use after free

cve-2021-21417

unix

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

7.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS

0.001

Percentile

39.3%

JSON

fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file (CVE-2021-21417).

OSVersionArchitecturePackageVersionFilename
Mageia7noarchfluidsynth< 2.0.5-1.1fluidsynth-2.0.5-1.1.mga7
Mageia8noarchfluidsynth< 2.1.8-1fluidsynth-2.1.8-1.mga8