[SECURITY] [DLA 3581-1] flac security update

2023-09-2510:04:23

lists.debian.org

cve-2020-22219

flac vulnerability buffer overflow

debian 10 buster

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.0%

JSON

Debian LTS Advisory DLA-3581-1 [email protected]
https://www.debian.org/lts/security/ Sean Whitton
September 25, 2023 https://wiki.debian.org/LTS

Package : flac
Version : 1.3.2-3+deb10u3
CVE ID : CVE-2020-22219

A buffer overflow vulnerability was found in FLAC, a free lossless audio
codec, in the bitwriter_grow_ function. This flaw may allow remote
attackers to run arbitrary code via specially crafted input to the
encoder.

For Debian 10 buster, this problem has been fixed in version
1.3.2-3+deb10u3.

We recommend that you upgrade your flac packages.

For the detailed security status of flac please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/flac

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian10i386libflac8-dbgsym< 1.3.2-3+deb10u3libflac8-dbgsym_1.3.2-3+deb10u3_i386.deb
Debian11arm64libflac8< 1.3.3-2+deb11u2libflac8_1.3.3-2+deb11u2_arm64.deb
Debian11amd64libflac++6v5< 1.3.3-2+deb11u2libflac++6v5_1.3.3-2+deb11u2_amd64.deb
Debian11arm64flac< 1.3.3-2+deb11u2flac_1.3.3-2+deb11u2_arm64.deb
Debian11armellibflac-dev< 1.3.3-2+deb11u2libflac-dev_1.3.3-2+deb11u2_armel.deb
Debian11ppc64ellibflac8-dbgsym< 1.3.3-2+deb11u2libflac8-dbgsym_1.3.3-2+deb11u2_ppc64el.deb
Debian11armhflibflac++-dev< 1.3.3-2+deb11u2libflac++-dev_1.3.3-2+deb11u2_armhf.deb
Debian11s390xlibflac++-dev< 1.3.3-2+deb11u2libflac++-dev_1.3.3-2+deb11u2_s390x.deb
Debian11i386flac-dbgsym< 1.3.3-2+deb11u2flac-dbgsym_1.3.3-2+deb11u2_i386.deb
Debian11mipsellibflac-dev< 1.3.3-2+deb11u2libflac-dev_1.3.3-2+deb11u2_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	i386	libflac8-dbgsym	< 1.3.2-3+deb10u3	libflac8-dbgsym_1.3.2-3+deb10u3_i386.deb
Debian	11	arm64	libflac8	< 1.3.3-2+deb11u2	libflac8_1.3.3-2+deb11u2_arm64.deb
Debian	11	amd64	libflac++6v5	< 1.3.3-2+deb11u2	libflac++6v5_1.3.3-2+deb11u2_amd64.deb
Debian	11	arm64	flac	< 1.3.3-2+deb11u2	flac_1.3.3-2+deb11u2_arm64.deb
Debian	11	armel	libflac-dev	< 1.3.3-2+deb11u2	libflac-dev_1.3.3-2+deb11u2_armel.deb
Debian	11	ppc64el	libflac8-dbgsym	< 1.3.3-2+deb11u2	libflac8-dbgsym_1.3.3-2+deb11u2_ppc64el.deb
Debian	11	armhf	libflac++-dev	< 1.3.3-2+deb11u2	libflac++-dev_1.3.3-2+deb11u2_armhf.deb
Debian	11	s390x	libflac++-dev	< 1.3.3-2+deb11u2	libflac++-dev_1.3.3-2+deb11u2_s390x.deb
Debian	11	i386	flac-dbgsym	< 1.3.3-2+deb11u2	flac-dbgsym_1.3.3-2+deb11u2_i386.deb
Debian	11	mipsel	libflac-dev	< 1.3.3-2+deb11u2	libflac-dev_1.3.3-2+deb11u2_mipsel.deb