Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large (1) Metadata Block Size, (2) VORBIS Comment String Size, (3) Picture Metadata MIME-TYPE Size, (4) Picture Description Size, (5) Picture Data Length, (6) Padding Length, and (7) PICTURE Metadata width and height values in a .FLAC file, which result in a heap-based overflow; and large (8) VORBIS Comment String Size Length, (9) Picture MIME-Type, (10) Picture MIME-Type URL, and (11) Picture Description Length values in a .FLAC file, which result in a stack-based overflow. NOTE: some of these issues may overlap CVE-2007-4619.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0975 advisory.

    [1.1.0-7.el_4.2]
     - Add RHEL-5 patch to remove execstack requirement      Related: rhbz #332591

     [1.1.0-7.el_4.1]
     - Add patch from Takashi Iwai to fix CVE-2007-4619      Resolves: rhbz #332591

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Sean de Regge and Greg Linares discovered multiple heap and stack based buffer overflows in FLAC, the Free Lossless Audio Codec, which could lead to the execution of arbitrary code.

An updated flac package to correct a security issue is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

FLAC is a Free Lossless Audio Codec. The flac package consists of a FLAC encoder and decoder in library form, a program to encode and decode FLAC files, a metadata editor for FLAC files and input plugins for various music players.

A security flaw was found in the way flac processed audio data. An attacker could create a carefully crafted FLAC audio file in such a way that it could cause an application linked with flac libraries to crash or execute arbitrary code when it was opened. (CVE-2007-4619)

Users of flac are advised to upgrade to this updated package, which contains a backported patch that resolves this issue.

ID	Name	Product	Family	Severity
67590	Oracle Linux 5 : Important: / flac (ELSA-2007-0975)	Nessus	Oracle Linux Local Security Checks	critical
30061	Debian DSA-1469-1 : flac - several vulnerabilities	Nessus	Debian Local Security Checks	high
27567	RHEL 4 / 5 : flac (RHSA-2007:0975)	Nessus	Red Hat Local Security Checks	high
27539	CentOS 4 / 5 : flac (CESA-2007:0975)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2007-6277

critical

Tenable Plugins

critical

high

high

high