Software Engineering Institute

FLAC (Free Lossless Audio Codec) is a lossless audio format. libFLAC is a library that can process FLAC files. libFLAC contains multiple vulnerabilities, including:

• Metadata Block Size Heap Overflow
• VORBIS Comment String Size Field Heap Overflow
• VORBIS Comment String Size Length Stack Overflow
• Picture MIME-Type Size Heap Overflow
• Picture MIME-Type Size Stack Overflow
• Picture Dimension Size Heap Overflow
• Picture Description Size Heap Overflow
• Picture Description Length Stack Overflow
• Picture Data Length Heap Overflow
• Picture URL Stack Overflow
• Malformed Image/File Download Vulnerability
• Padding Length Heap Overflow
• Seektable Out-Of-Scope Double Free Condition
• Malformed Seektable Double Free Condition

By convincing a user to open a specially crafted FLAC file, a remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition on a vulnerable system.

Apply an update
These issues are addressed in version 1.2.1 of the FLAC library. Please see the Systems Affected section for fix availability for specific products.