From dfc3df7b84ca2f4e71366f32d1126f521c116efa Mon Sep 17 00:00:00 2001 From: Ralph Giles Date: Thu, 16 Jul 2020 10:23:10 -0700 Subject: Reference CVE-2018-10392 in the release notes. The fix for this issue was in the 1.3.7 release, but we didn't refer to the CVE number explicitly in the release notes. Do so now for the benefit of anyone auditing vulnerability fixes in the future. Signed-off-by: Mark Harris --- CHANGES | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGES b/CHANGES index c4a0addf..ba0c3ca0 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,7 @@ libvorbis 1.3.7 (2020-07-04) -- "Xiph.Org libVorbis I 20200704 (Reducing Environ * Fix CVE-2018-10393 - out-of-bounds read encoding very low sample rates. * Fix CVE-2017-14160 - out-of-bounds read encoding very low sample rates. +* Fix CVE-2018-10392 - out-of-bounds access encoding invalid channel count. * Fix handling invalid bytes per sample arguments. * Fix handling invalid channel count arguments. * Fix invalid free on seek failure. -- cgit v1.2.1