Bug 415581 (CVE-2007-6277)

Summary:	CVE-2007-6277 libflac: Multiple security issues fixed in 1.2.1
Product:	[Other] Security Response	Reporter:	Red Hat Product Security <security-response-team>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bnocera, mlichvar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6277
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-07-25 10:30:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lubomir Kundrak 2007-12-07 13:17:33 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6277 to the following vulnerability:

Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large (1) Metadata Block Size, (2) VORBIS Comment String Size, (3) Picture Metadata MIME-TYPE Size, (4) Picture Description Size, (5) Picture Data Length, (6) Padding Length, and (7) PICTURE Metadata width and height values in a .FLAC file, which result in a heap-based overflow; and large (8) VORBIS Comment String Size Length, (9) Picture MIME-Type, (10) Picture MIME-Type URL, and (11) Picture Description Length values in a .FLAC file, which result in a stack-based overflow.  NOTE: some of these issues may overlap CVE-2007-4619.

References:

http://research.eeye.com/html/advisories/published/AD20071115.html
http://www.securityfocus.com/archive/1/archive/1/483765/100/200/threaded
http://www.kb.cert.org/vuls/id/544656
http://www.securitytracker.com/id?1018974

Comment 1 Lubomir Kundrak 2007-12-07 14:35:46 UTC

Most likely this is a complete duplicate of bug #331991, which was addressed by
RHSA-2007:0975 [1], but it needs to be checked again to be completely sure.

https://rhn.redhat.com/errata/RHSA-2007-0975.html

Comment 2 Robert Buchholz 2007-12-10 15:34:13 UTC

Version in $title should read 1.2.1.

Comment 4 Tomas Hoger 2008-07-25 10:30:30 UTC


*** This bug has been marked as a duplicate of 331991 ***

Comment 5 Red Hat Bugzilla 2009-10-23 19:06:15 UTC

Reporter changed to security-response-team by request of Jay Turner.