Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder.

According to the versions of the flac package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the flac package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:5046 advisory.

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of flac installed on the remote host is prior to 1.3.0-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2283 advisory.

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3581 advisory.

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6360-2 advisory.

    USN-6360-1 fixed a vulnerability in FLAC. This update provides the corresponding update for Ubuntu 14.04     LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3635-1 advisory.

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5500 advisory.

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-bf8423a373 advisory.

    Security fix for CVE-2020-22219

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5046 advisory.

    [1.3.2-9.el8_8.1]
    - don't free memory that is still used after realloc() error (CVE-2020-22219)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5048 advisory.

    [1.3.3-10.el9_2.1]
    - don't free memory that is still used after realloc() error (CVE-2020-22219)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6360-1 advisory.

    It was discovered that FLAC incorrectly handled encoding certain files. A remote attacker could use this     issue to cause FLAC to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5048 advisory.

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5046 advisory.

  - Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to     run arbitrary code via crafted input to the encoder. (CVE-2020-22219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5048 advisory.

    FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project     consists of the stream format, reference encoders and decoders in library form, a command-line program to     encode and decode FLAC files, and a command-line metadata editor for FLAC files.

    Security Fix(es):

    * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the     encoder (CVE-2020-22219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5046 advisory.

    FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project     consists of the stream format, reference encoders and decoders in library form, a command-line program to     encode and decode FLAC files, and a command-line metadata editor for FLAC files.

    Security Fix(es):

    * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the     encoder (CVE-2020-22219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5045 advisory.

    FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project     consists of the stream format, reference encoders and decoders in library form, a command-line program to     encode and decode FLAC files, and a command-line metadata editor for FLAC files.

    Security Fix(es):

    * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the     encoder (CVE-2020-22219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5047 advisory.

    FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project     consists of the stream format, reference encoders and decoders in library form, a command-line program to     encode and decode FLAC files, and a command-line metadata editor for FLAC files.

    Security Fix(es):

    * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the     encoder (CVE-2020-22219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5044 advisory.

    FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project     consists of the stream format, reference encoders and decoders in library form, a command-line program to     encode and decode FLAC files, and a command-line metadata editor for FLAC files.

    Security Fix(es):

    * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the     encoder (CVE-2020-22219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5042 advisory.

    FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project     consists of the stream format, reference encoders and decoders in library form, a command-line program to     encode and decode FLAC files, and a command-line metadata editor for FLAC files.

    Security Fix(es):

    * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the     encoder (CVE-2020-22219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5043 advisory.

    FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project     consists of the stream format, reference encoders and decoders in library form, a command-line program to     encode and decode FLAC files, and a command-line metadata editor for FLAC files.

    Security Fix(es):

    * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the     encoder (CVE-2020-22219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
197253	EulerOS Virtualization 3.0.6.0 : flac (EulerOS-SA-2024-1679)	Nessus	Huawei Local Security Checks	high
196451	RHEL 6 : flac (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
191814	EulerOS 2.0 SP8 : flac (EulerOS-SA-2024-1263)	Nessus	Huawei Local Security Checks	high
190156	CentOS 8 : flac (CESA-2023:5046)	Nessus	CentOS Local Security Checks	high
188438	EulerOS 2.0 SP10 : flac (EulerOS-SA-2023-3207)	Nessus	Huawei Local Security Checks	high
188380	EulerOS 2.0 SP9 : flac (EulerOS-SA-2023-2893)	Nessus	Huawei Local Security Checks	high
188283	EulerOS 2.0 SP9 : flac (EulerOS-SA-2023-2874)	Nessus	Huawei Local Security Checks	high
188094	EulerOS 2.0 SP10 : flac (EulerOS-SA-2023-3172)	Nessus	Huawei Local Security Checks	high
182634	Amazon Linux 2 : flac (ALAS-2023-2283)	Nessus	Amazon Linux Local Security Checks	high
181845	Debian DLA-3581-1 : flac - LTS security update	Nessus	Debian Local Security Checks	high
181769	Ubuntu 16.04 ESM / 18.04 ESM : FLAC vulnerability (USN-6360-2)	Nessus	Ubuntu Local Security Checks	high
181586	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : flac (SUSE-SU-2023:3635-1)	Nessus	SuSE Local Security Checks	high
181566	Debian DSA-5500-1 : flac - security update	Nessus	Debian Local Security Checks	high
181489	Fedora 37 : flac (2023-bf8423a373)	Nessus	Fedora Local Security Checks	high
181391	Oracle Linux 8 : flac (ELSA-2023-5046)	Nessus	Oracle Linux Local Security Checks	high
181366	Oracle Linux 9 : flac (ELSA-2023-5048)	Nessus	Oracle Linux Local Security Checks	high
181316	Ubuntu 20.04 LTS / 22.04 LTS : FLAC vulnerability (USN-6360-1)	Nessus	Ubuntu Local Security Checks	high
181269	AlmaLinux 9 : flac (ALSA-2023:5048)	Nessus	Alma Linux Local Security Checks	high
181268	AlmaLinux 8 : flac (ALSA-2023:5046)	Nessus	Alma Linux Local Security Checks	high
181244	RHEL 9 : flac (RHSA-2023:5048)	Nessus	Red Hat Local Security Checks	high
181242	RHEL 8 : flac (RHSA-2023:5046)	Nessus	Red Hat Local Security Checks	high
181241	RHEL 8 : flac (RHSA-2023:5045)	Nessus	Red Hat Local Security Checks	high
181240	RHEL 9 : flac (RHSA-2023:5047)	Nessus	Red Hat Local Security Checks	high
181239	RHEL 8 : flac (RHSA-2023:5044)	Nessus	Red Hat Local Security Checks	high
181234	RHEL 8 : flac (RHSA-2023:5042)	Nessus	Red Hat Local Security Checks	high
181233	RHEL 8 : flac (RHSA-2023:5043)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-22219

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high