PT-2007-7462 · Xiph.Org+2 · Liboggflac++-Dev+14

Published 1970-01-01 · Updated 2017-09-29 · CVE-2007-4619

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libFLAC versions prior to 1.2.1 flac versions prior to 1.2.1-r1 libflac-dev (affected versions not specified) liboggflac-dev (affected versions not specified) libflac6 (affected versions not specified) liboggflac++-dev (affected versions not specified) flac-devel-1.1.0 (affected versions not specified) libflac++5 (affected versions not specified) libflac++-dev (affected versions not specified) liboggflac1 (affected versions not specified) liboggflac3 (affected versions not specified) libflac++4 (affected versions not specified) liboggflac++0c102 (affected versions not specified) libflac7 (affected versions not specified) liboggflac++2 (affected versions not specified) flac-1.1.0 (affected versions not specified) flac-devel-1.1.2 (affected versions not specified) libflac-doc (affected versions not specified) xmms-flac (affected versions not specified) flac-1.1.2 (affected versions not specified)

Description The issue is related to multiple integer overflows in the Free Lossless Audio Codec (FLAC) library, which can be exploited by remote attackers to execute arbitrary code via a malformed FLAC file, resulting in a heap-based buffer overflow. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be carried out remotely.

Recommendations For libFLAC versions prior to 1.2.1, update to version 1.2.1 or later. For flac versions prior to 1.2.1-r1, update to version 1.2.1-r1 or later. For other affected versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-00795

BDU:2015-00796

BDU:2015-00797

BDU:2015-00798

BDU:2015-00799

BDU:2015-00800

BDU:2015-00801

BDU:2015-00802

BDU:2015-00803

BDU:2015-00804

BDU:2015-00805

BDU:2015-00806

BDU:2015-00807

BDU:2015-00808

BDU:2015-06171

BDU:2015-06172

BDU:2015-06173

BDU:2015-06174

BDU:2015-09600

CVE-2007-4619

DSA-1469-1

RHSA-2007:0975

RHSA-2007_0975

Affected Products

Red Hat

Flac

Flac-Devel

Libflac

Libflac-Dev

Libflac++4

Libflac++5

Libflac6

Libflac7

Liboggflac++-Dev

Liboggflac++0C102

Liboggflac++2

Liboggflac1

Liboggflac3

Xmms-Flac

References · 62

• https://redhat.com/archives/fedora-package-announce/2007-November/msg00035.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00801 · Security Note
• https://bdu.fstec.ru/vul/2015-06174 · Security Note
• http://security.gentoo.org/glsa/glsa-200711-15.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00807 · Security Note
• http://debian.org/security/2008/dsa-1469 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4619 · Security Note
• https://bdu.fstec.ru/vul/2015-00797 · Security Note
• https://bdu.fstec.ru/vul/2015-00800 · Security Note
• http://flac.sourceforge.net/changelog.html#flac_1_2_1 · Patch
• http://mandriva.com/security/advisories?name=MDKSA-2007:214 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06173 · Security Note
• https://osv.dev/vulnerability/CVE-2007-4619 · Vendor Advisory
• http://securityfocus.com/bid/26042 · Patch
• https://bdu.fstec.ru/vul/2015-00805 · Security Note