PT-2020-6915 · Flac+8 · Flac+8

Ltx2018 · Published 2020-06-02 · Updated 2025-01-20 · CVE-2020-22219

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions flac versions prior to 1.4.0

Description The issue is related to a buffer overflow in the bitwriter grow function of the FLAC audio codec, which can allow an attacker to execute arbitrary code. This can be achieved by providing crafted input to the encoder.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the bitwriter grow function in the FLAC encoder until a patch is available.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALSA-2023:5046

ALSA-2023:5048

ALT-PU-2024-1901

AZL-28074

BDU:2023-06152

CESA-2023_5046

CVE-2020-22219

DLA-3581-1

DSA-5500-1

INFSA-2023_5048

MGASA-2023-0277

OESA-2023-1562

OPENSUSE-SU-2023_3635-1

RHSA-2023:5042

RHSA-2023:5043

RHSA-2023:5044

RHSA-2023:5045

RHSA-2023:5046

RHSA-2023:5047

RHSA-2023:5048

RHSA-2023_5046

RHSA-2023_5048

SUSE-SU-2023:3635-1

SUSE-SU-2023_3635-1

USN-6360-1

USN-6360-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Flac

References · 49

• 🔥 https://github.com/xiph/flac/issues/215 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2020-22219 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-5048.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-6360-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZD2AJTU4PCJQP7HPTS2L2ELJWBASCRGD · Vendor Advisory
• https://osv.dev/vulnerability/USN-6360-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22219 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-5046.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-22219 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-22219 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-22219 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0212SE17 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0277.html · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-22219 · Security Note