Out of Bounds Write Vulnerability in FLAC Package - CVE-2021-0561
Summary
ALPINE-CVE-2021-0561: In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. Affects flac versions < 1.3.4-r0. Fixed in 1.3.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FLAC (Free Lossless Audio Codec) is an open-source audio format that compresses audio without any loss in quality. It is widely used for storing high-quality audio files. The package is essential for applications that require lossless audio playback and is supported across various platforms. However, it has been identified to have a vulnerability that could lead to potential information disclosure.
Vulnerability Detail
The vulnerability identified as CVE-2021-0561 arises from a missing bounds check in the function append_to_verify_fifo_interleaved_ of stream_encoder.c. This oversight allows for an out-of-bounds write, which could lead to local information disclosure. The vulnerability does not require any additional execution privileges or user interaction for exploitation, making it a significant security concern.
How To Fix
Minimum fixed version
1.3.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade flacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider restricting access to the affected application or using alternative audio encoding libraries until the package can be updated.
Conclusion
In summary, CVE-2021-0561 is a critical vulnerability in the FLAC package that can lead to local information disclosure due to an out-of-bounds write. It is essential to update to the patched version 1.3.4-r0 to secure your application against this vulnerability.
See every vulnerability recorded for flac →
FAQ
CVE-2021-0561 is a vulnerability in the FLAC package that allows for an out-of-bounds write due to a missing bounds check.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to local information disclosure, which means sensitive data could be exposed without requiring additional privileges.
Yes, the patched version of the FLAC package is 1.3.4-r0. It is recommended to update to this version to mitigate the risk.
The CVSS score of this vulnerability is 5.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for flac.
