CVE-2014-9028 Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
HighCVSS 7.5
EPSS 9.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/flac(Debian:12) | < 1.3.0-3 | 1.3.0-3 |
| debian/flac(Debian:13) | < 1.3.0-3 | 1.3.0-3 |
| debian/flac(Debian:14) | < 1.3.0-3 | 1.3.0-3 |
| flac libflac | <= 1.3.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-9028 vendor-advisory
- advisories.mageia.org
- openSUSE-SU-2014:1588 vendor-advisory
- packetstormsecurity.com
- RHSA-2015:0767 vendor-advisory
- DSA-3082 vendor-advisory
- MDVSA-2014:239 vendor-advisory
- MDVSA-2015:188 vendor-advisory
- www.ocert.org us-government-resource
- www.oracle.com
- 20141125 [oCERT 2014-008] libFLAC multiple issues mailing-list
- 71282 vdb-entry
- USN-2426-1 vendor-advisory
- git.xiph.org
- bugs.debian.org issue-tracking