[Secure-testing-team] Bug#870333: libid3tag: CVE-2017-11551

[Salvatore Bonaccorso]

Source: libid3tag
Version: 0.15.1b-11
Severity: normal
Tags: security upstream

Hi,

the following vulnerability was published for libid3tag.

CVE-2017-11551[0]:
| The id3_field_parse function in field.c in libid3tag 0.15.1b allows
| remote attackers to cause a denial of service (OOM) via a crafted MP3
| file.

Quickly skimming over the code looks this would be present. But please
double-check. This CVE is the second of the issues listed at [1].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11551
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11551
[1] http://seclists.org/fulldisclosure/2017/Jul/85

Regards,
Salvatore