[SECURITY] [DSA 5500-1] flac security update

2023-09-1821:39:24

lists.debian.org

cve-2020-22219

flac

buffer overflow

debian

security update

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

38.8%

JSON

Debian Security Advisory DSA-5500-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
September 18, 2023 https://www.debian.org/security/faq

Package : flac
CVE ID : CVE-2020-22219

A buffer overflow was discovered in flac, a library handling Free
Lossless Audio Codec media, which could potentially result in the
execution of arbitrary code.

For the oldstable distribution (bullseye), this problem has been fixed
in version 1.3.3-2+deb11u2.

We recommend that you upgrade your flac packages.

For the detailed security status of flac please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/flac

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian11arm64libflac8< 1.3.3-2+deb11u2libflac8_1.3.3-2+deb11u2_arm64.deb
Debian11i386libflac8-dbgsym< 1.3.3-2+deb11u2libflac8-dbgsym_1.3.3-2+deb11u2_i386.deb
Debian10armhflibflac8< 1.3.2-3+deb10u3libflac8_1.3.2-3+deb10u3_armhf.deb
Debian11s390xlibflac8-dbgsym< 1.3.3-2+deb11u2libflac8-dbgsym_1.3.3-2+deb11u2_s390x.deb
Debian11ppc64ellibflac8< 1.3.3-2+deb11u2libflac8_1.3.3-2+deb11u2_ppc64el.deb
Debian11arm64libflac++6v5-dbgsym< 1.3.3-2+deb11u2libflac++6v5-dbgsym_1.3.3-2+deb11u2_arm64.deb
Debian11amd64flac< 1.3.3-2+deb11u2flac_1.3.3-2+deb11u2_amd64.deb
Debian10amd64libflac-dev< 1.3.2-3+deb10u3libflac-dev_1.3.2-3+deb10u3_amd64.deb
Debian11amd64libflac++-dev< 1.3.3-2+deb11u2libflac++-dev_1.3.3-2+deb11u2_amd64.deb
Debian11armhflibflac-dev< 1.3.3-2+deb11u2libflac-dev_1.3.3-2+deb11u2_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	arm64	libflac8	< 1.3.3-2+deb11u2	libflac8_1.3.3-2+deb11u2_arm64.deb
Debian	11	i386	libflac8-dbgsym	< 1.3.3-2+deb11u2	libflac8-dbgsym_1.3.3-2+deb11u2_i386.deb
Debian	10	armhf	libflac8	< 1.3.2-3+deb10u3	libflac8_1.3.2-3+deb10u3_armhf.deb
Debian	11	s390x	libflac8-dbgsym	< 1.3.3-2+deb11u2	libflac8-dbgsym_1.3.3-2+deb11u2_s390x.deb
Debian	11	ppc64el	libflac8	< 1.3.3-2+deb11u2	libflac8_1.3.3-2+deb11u2_ppc64el.deb
Debian	11	arm64	libflac++6v5-dbgsym	< 1.3.3-2+deb11u2	libflac++6v5-dbgsym_1.3.3-2+deb11u2_arm64.deb
Debian	11	amd64	flac	< 1.3.3-2+deb11u2	flac_1.3.3-2+deb11u2_amd64.deb
Debian	10	amd64	libflac-dev	< 1.3.2-3+deb10u3	libflac-dev_1.3.2-3+deb10u3_amd64.deb
Debian	11	amd64	libflac++-dev	< 1.3.3-2+deb11u2	libflac++-dev_1.3.3-2+deb11u2_amd64.deb
Debian	11	armhf	libflac-dev	< 1.3.3-2+deb11u2	libflac-dev_1.3.3-2+deb11u2_armhf.deb