Bug 246322 (CVE-2007-3507)

Summary:	CVE-2007-3507 flac123 0.0.9 vorbis comment parsing buffer overflow
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	flac123	Assignee:	Sindre Pedersen Bjørdal <sindrepb>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7	CC:	fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://www.vuxml.org/freebsd/32d38cbb-2632-11dc-94da-0016179b2dd5.html
Whiteboard:
Fixed In Version:	0.0.11-1.fc7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-07-12 23:38:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2007-06-30 08:18:21 UTC

http://www.vuxml.org/freebsd/32d38cbb-2632-11dc-94da-0016179b2dd5.html

"flac123, also known as flac-tools, is vulnerable to a buffer overflow in vorbis
comment parsing. This allows for the execution of arbitrary code."

0.0.10 is out, supposedly containing a fix for this.

Comment 1 Sindre Pedersen Bjørdal 2007-07-12 13:36:32 UTC

Updated flac123 to 0.0.11, submitted update for updates-testing for F-7. Will go
into updates shortly if there's no trouble.

Comment 2 Fedora Update System 2007-07-12 23:38:03 UTC

flac123-0.0.11-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.