CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
Percentile
97.5%
Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted
remote attackers to force a client to download arbitrary files via the
MIME-Type URL flag (–>) for the FLAC image file in a crafted .FLAC file.
Author | Note |
---|---|
jdstrand | checked diff from 1.2.0 to 1.2.1 and found the mime parts. These were included in the fix for CVE-2007-4619 for gutsy. 1.1.2 does not have the mime code in libFLAC note that CVE-2007-4619 was very general and came out before the iDefense CVEs, so there is overlap |