CVE-2014-8962 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Flac

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-122 — Heap-based Buffer Overflow10 documents7 sources
Severity
7.5HIGHNVD
EPSS
14.7%
top 5.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Flac Project FlacDebian FlacFlac Libflac
Timeline
PublishedNov 26
Latest updateMay 14

Description

Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶NVDflac/libflac1.3.0
▶debiandebian/flac< flac 1.3.0-3 (bookworm)
▶Debianflac_project/flac< 1.3.0-3+3

🔴Vulnerability Details

2
GHSA
GHSA-5gr4-m4m2-fjjf: Stack-based buffer overflow in stream_decoder↗2022-05-14
▶
OSV
CVE-2014-8962: Stack-based buffer overflow in stream_decoder↗2014-11-26
▶

📋Vendor Advisories

3
Ubuntu
FLAC vulnerabilities↗2014-11-27
▶
Red Hat
flac: Buffer read overflow when processing ID3V2 metadata↗2014-11-18
▶
Debian
CVE-2014-8962: flac - Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows r...↗2014
▶

💬Community

4
Bugzilla
CVE-2014-9028 CVE-2014-8962 mingw-flac: various flaws [fedora-all]↗2014-12-02
▶
Bugzilla
CVE-2014-9028 CVE-2014-8962 xmms-flac: various flaws [fedora-all]↗2014-12-02
▶
Bugzilla
CVE-2014-9028 CVE-2014-8962 flac: various flaws [fedora-all]↗2014-12-02
▶
Bugzilla
CVE-2014-8962 flac: Buffer read overflow when processing ID3V2 metadata↗2014-11-24
▶