fkie_cve-2007-4619
Vulnerability from fkie_nvd
Published
2007-10-12 21:17
Modified
2024-11-21 00:36
Severity ?
Summary
Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow.
References
cve@mitre.orghttp://bugzilla.redhat.com/show_bug.cgi?id=331991
cve@mitre.orghttp://flac.sourceforge.net/changelog.html#flac_1_2_1Patch
cve@mitre.orghttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html
cve@mitre.orghttp://secunia.com/advisories/27210
cve@mitre.orghttp://secunia.com/advisories/27223
cve@mitre.orghttp://secunia.com/advisories/27355
cve@mitre.orghttp://secunia.com/advisories/27399
cve@mitre.orghttp://secunia.com/advisories/27507
cve@mitre.orghttp://secunia.com/advisories/27601
cve@mitre.orghttp://secunia.com/advisories/27625
cve@mitre.orghttp://secunia.com/advisories/27628
cve@mitre.orghttp://secunia.com/advisories/27780
cve@mitre.orghttp://secunia.com/advisories/27878
cve@mitre.orghttp://secunia.com/advisories/28548
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200711-15.xml
cve@mitre.orghttp://securitytracker.com/id?1018815
cve@mitre.orghttp://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243
cve@mitre.orghttp://www.debian.org/security/2008/dsa-1469
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2007:214
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2007-0975.html
cve@mitre.orghttp://www.securityfocus.com/bid/26042Patch
cve@mitre.orghttp://www.ubuntu.com/usn/usn-540-1
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/3483
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/3484
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/4061
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=332571
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/37187
cve@mitre.orghttps://issues.rpath.com/browse/RPL-1873
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10571
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html
af854a3a-2127-422b-91ae-364da2661108http://bugzilla.redhat.com/show_bug.cgi?id=331991
af854a3a-2127-422b-91ae-364da2661108http://flac.sourceforge.net/changelog.html#flac_1_2_1Patch
af854a3a-2127-422b-91ae-364da2661108http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27210
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27223
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27355
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27399
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27507
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27601
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27625
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27628
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27780
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27878
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28548
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200711-15.xml
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1018815
af854a3a-2127-422b-91ae-364da2661108http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2008/dsa-1469
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2007:214
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2007-0975.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/26042Patch
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/usn-540-1
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/3483
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/3484
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/4061
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=332571
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/37187
af854a3a-2127-422b-91ae-364da2661108https://issues.rpath.com/browse/RPL-1873
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10571
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html
Impacted products
Vendor Product Version
flac libflac *
nullsoft winamp *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:flac:libflac:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D389BAA-4D7C-4126-8D3D-9C8286BDBB45",
              "versionEndIncluding": "1.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "366727E0-07BA-4D81-8EB2-7B291722C558",
              "versionEndIncluding": "5.35",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples desbordamientos de entero en Free Lossless Audio Codec (FLAC) libFLAC versiones anteriores a 1.2.1, como se usan Winamp versiones anteriores a 5.5 y otros productos, permiten a atacantes remotos con la complicidad del usuario ejecutar c\u00f3digo de su elecci\u00f3n mediante un fichero FLAC malformado que dispara una ubicaci\u00f3n de memoria inapropiada, resultando en un desbordamiento de b\u00fafer basado en mont\u00edculo."
    }
  ],
  "id": "CVE-2007-4619",
  "lastModified": "2024-11-21T00:36:02.093",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2007-10-12T21:17:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugzilla.redhat.com/show_bug.cgi?id=331991"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://flac.sourceforge.net/changelog.html#flac_1_2_1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27210"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27223"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27355"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27399"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27507"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27601"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27625"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27628"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27780"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27878"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/28548"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200711-15.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1018815"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2008/dsa-1469"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:214"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0975.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/26042"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/usn-540-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/3483"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/3484"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/4061"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=332571"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37187"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://issues.rpath.com/browse/RPL-1873"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10571"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugzilla.redhat.com/show_bug.cgi?id=331991"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://flac.sourceforge.net/changelog.html#flac_1_2_1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27210"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27223"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27355"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27399"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27507"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27601"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27625"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27628"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27780"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27878"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/28548"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200711-15.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1018815"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2008/dsa-1469"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:214"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0975.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/26042"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/usn-540-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/3483"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/3484"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/4061"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=332571"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37187"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.rpath.com/browse/RPL-1873"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10571"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.