Bug 2235489 (CVE-2020-22219)
| Summary: | CVE-2020-22219 flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Anten Skrabec <askrabec> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | dfreiber, eglynn, fhrdina, jburrell, jjoyce, jschluet, lhh, mburns, mgarciac, mlichvar, mvanb1, pgrist, rogbas, sbroz, vkumar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | flac 1.4.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the libeconf library. This issue occurs due to a buffer overflow vulnerability in the bitwriter_grow_ function in FLAC that allows remote attackers to run arbitrary code via crafted input to the encoder.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2235501, 2235502, 2235503, 2235504, 2235505, 2235506, 2235507, 2235508, 2235509, 2235510, 2235512, 2235513, 2235580, 2235581, 2235582, 2235583, 2235584, 2235585, 2235586, 2235587, 2235588 | ||
| Bug Blocks: | 2235490 | ||
|
Description
Anten Skrabec
2023-08-28 20:58:42 UTC
Created flac tracking bugs for this issue: Affects: fedora-all [bug 2235580] As the current maintainer of FLAC, I'm a little puzzled I haven't been contacted about this. I would really like to know what has happened here, because this bug can only be triggered by supplying invalid data to the libFLAC. I agree that libFLAC should not show this behaviour, which is why it was fixed. However, this problem is not exploitable through most tools, like the flac command line tool. So, I'd really like to know which tool can be used to supply this invalid data? I can't really seem to find the connection between libeconf and libFLAC? This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2023:5042 https://access.redhat.com/errata/RHSA-2023:5042 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2023:5043 https://access.redhat.com/errata/RHSA-2023:5043 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2023:5044 https://access.redhat.com/errata/RHSA-2023:5044 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:5047 https://access.redhat.com/errata/RHSA-2023:5047 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:5045 https://access.redhat.com/errata/RHSA-2023:5045 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:5046 https://access.redhat.com/errata/RHSA-2023:5046 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:5048 https://access.redhat.com/errata/RHSA-2023:5048 (Sorry, I accidentally modified this bug - reverting...) |