debian/flac vulnerabilities

Latest debian/flac CVEs

Newest publication first

1. DLA-3581-1 flac - security update

   Published 2023-09-25

   Unknown

2. DSA-5500-1 flac - security update

   Published 2023-09-18

   Unknown

3. CVE-2020-22219 Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder.

   Published 2023-08-22

   High·CVSS 7.8 EPSS 0.79%

   Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder.

4. DLA-3094-1 flac - security update

   Published 2022-09-04

   Unknown

5. DLA-2951-1 flac - security update

   Published 2022-03-17

   Unknown

6. CVE-2021-0561 In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional exe...

   Published 2021-06-22

   Medium·CVSS 5.5 EPSS 0.46%

   In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

7. DLA-2514-1 flac - security update

   Published 2021-01-04

   Unknown

8. CVE-2020-0499 In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional exec...

   Published 2020-12-15

   Medium·CVSS 4.3 EPSS 4.1%

   In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: An...

9. CVE-2017-6888 An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.

   Published 2018-04-25

   Medium·CVSS 5.5 EPSS 1.3%

   An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.

10. DLA-99-1 flac - security update

    Published 2014-12-05

    Unknown

11. DSA-3082-1 flac - security update

    Published 2014-11-30

    Unknown

12. CVE-2014-9028 Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.

    Published 2014-11-26

    High·CVSS 7.5 EPSS 9.9%

    Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.

13. CVE-2014-8962 Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.

    Published 2014-11-26

    High·CVSS 7.5 EPSS 9.9%

    Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.

14. DSA-1469-1 flac

    Published 2008-01-20

    Unknown

15. CVE-2007-6279 Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via malformed (1) Seektable values or (2) S...

    Published 2007-12-07

    High·CVSS 9.3 EPSS 4.0%

    Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via malformed (1) Seektable values or (2) Seektable Data Offsets in a .FLAC file.

16. CVE-2007-6278 Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to download arbitrary files via the MIME-Type URL flag (-->) for the FLAC image file in a....

    Published 2007-12-07

    High·CVSS 9.3 EPSS 2.1%

    Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to download arbitrary files via the MIME-Type URL flag (-->) for the FLAC image file in a crafted .FLAC file.

17. CVE-2007-6277 Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large (1) Metadata Block Size, (2) VORBIS Comment....

    Published 2007-12-07

    High·CVSS 9.3 EPSS 6.7%

    Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large (1) Metadata Block Size, (2) VORBIS Comment String Size, (3) Picture Metadata MIME-TYPE Size, (4) Picture Description Size,...

18. CVE-2007-4619 Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via...

    Published 2007-10-12

    High·CVSS 9.3 EPSS 6.7%

    Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.