CVE-2014-9028 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Flac

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-122 — Heap-based Buffer Overflow11 documents8 sources
Severity
7.5HIGHNVD
EPSS
25.7%
top 3.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Flac Project FlacDebian FlacFlac Libflac+1 more
Timeline
PublishedNov 26
Latest updateMay 14

Description

Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages4 packages

▶NVDflac/libflac1.3.0
▶debiandebian/flac< flac 1.3.0-3 (bookworm)
▶Debianflac_project/flac< 1.3.0-3+3

🔴Vulnerability Details

2
GHSA
GHSA-6x2f-7ggw-rc86: Heap-based buffer overflow in stream_decoder↗2022-05-14
▶
OSV
CVE-2014-9028: Heap-based buffer overflow in stream_decoder↗2014-11-26
▶

📋Vendor Advisories

4
Android
CVE-2014-9028: Android Security Bulletin 2015-10-01 CVE: CVE-2014-9028 Severity: CRITICAL Affected AOSP versions: 5↗2015-10-01
▶
Ubuntu
FLAC vulnerabilities↗2014-11-27
▶
Red Hat
flac: Heap buffer write overflow in read_residual_partitioned_rice_↗2014-11-25
▶
Debian
CVE-2014-9028: flac - Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows re...↗2014
▶

💬Community

4
Bugzilla
CVE-2014-9028 CVE-2014-8962 mingw-flac: various flaws [fedora-all]↗2014-12-02
▶
Bugzilla
CVE-2014-9028 CVE-2014-8962 xmms-flac: various flaws [fedora-all]↗2014-12-02
▶
Bugzilla
CVE-2014-9028 CVE-2014-8962 flac: various flaws [fedora-all]↗2014-12-02
▶
Bugzilla
CVE-2014-9028 flac: Heap buffer write overflow in read_residual_partitioned_rice_↗2014-11-25
▶