Debian Security Advisory
DLA-2514-1 flac -- LTS security update
- Date Reported:
- 04 Jan 2021
- Affected Packages:
- flac
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 897015.
In Mitre's CVE dictionary: CVE-2017-6888, CVE-2020-0499. - More information:
-
Two vulnerabilities were fixed in flac, the library for the Free Lossless Audio Codec.
- CVE-2017-6888
Memory leak via a specially crafted FLAC file
- CVE-2020-0499
Out of bounds read due to a heap buffer overflow
For Debian 9 stretch, these problems have been fixed in version 1.3.2-2+deb9u1.
We recommend that you upgrade your flac packages.
For the detailed security status of flac please refer to its security tracker page at: https://security-tracker.debian.org/tracker/flac
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
- CVE-2017-6888