Heap Buffer Overflow in FLAC__bitreader_read_rice_signed_block
Summary
CVE-2020-0499: In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. Affects flac versions < 1.3.4-r0. Fixed in 1.3.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FLAC package is an open-source audio coding format that compresses audio files without any loss in quality. It is widely used for archiving and distributing high-quality audio content. The vulnerability, identified as CVE-2020-0499, affects the bitreader.c file in the FLAC package. This vulnerability allows for a heap buffer overflow, leading to a potential out of bounds read. The vulnerability can be exploited remotely, requiring user interaction, and may result in the disclosure of sensitive information.
Vulnerability Detail
The vulnerability originates from the FLAC__bitreader_read_rice_signed_block function in the bitreader.c file. Due to a heap buffer overflow, an out of bounds read can occur. This can be exploited remotely without the need for additional execution privileges. The impact of this vulnerability is the potential disclosure of remote information. The vulnerability has been assigned a CVSS score of 4.3.
How To Fix
Minimum fixed version
1.3.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade flacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The FLAC package is susceptible to a heap buffer overflow vulnerability, which can lead to the disclosure of remote information. It is crucial to update the package to the latest version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flac →
FAQ
FLAC is an open-source audio coding format that allows for lossless compression of audio files.
The vulnerability can lead to the disclosure of remote information, potentially compromising sensitive data.
Yes, user interaction is needed for the vulnerability to be exploited.
The vulnerability has been assigned a CVSS score of 4.3.
Updating the FLAC package to version 1.3.4-r0 or later will address the vulnerability and mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for flac.
