Bug 1573058 – CVE-2017-6888 flac: Memory leak in src/libFLAC/stream_decoder.c:read_metadata_vorbiscomment_()

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1573058 - (CVE-2017-6888) CVE-2017-6888 flac: Memory leak in src/libFLAC/stream_decoder.c:read_metadata_vorbiscomment_()

Summary:	CVE-2017-6888 flac: Memory leak in src/libFLAC/stream_decoder.c:read_metadata...

Status:	NEW

Aliases:	CVE-2017-6888

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20170511,reported=2...
Keywords:	Security

Depends On:	1573060 1573061 1573062
Blocks:	1573063
	Show dependency tree / graph

Reported:	2018-04-30 01:12 EDT by Sam Fowler
Modified:	2018-05-16 07:55 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Sam Fowler 2018-04-30 01:12:27 EDT

FLAC version 1.3.2 has a memory leak vulnerability in the src/libFLAC/stream_decoder.c:read_metadata_vorbiscomment_() function. An attacker could exploit this via crafted FLAC file to cause a denial of service.


External Reference:

https://secuniaresearch.flexerasoftware.com/secunia_research/2017-7/


Upstream Patch:

https://git.xiph.org/?p=flac.git;a=blobdiff;f=src/libFLAC/stream_decoder.c;h=a5527511d195f9428c817ad6dbe57e8af03a2f1b;hp=14d5fe7ff3e81f38554c057fcd7d86830a582257;hb=4f47b63e9c971e6391590caf00a0f2a5ed612e67;hpb=25b2d82fe4982edbcb54913f4f5db0a1ae9c726d

Comment 1 Sam Fowler 2018-04-30 01:13:00 EDT

Created flac tracking bugs for this issue:

Affects: fedora-all [bug 1573062]


Created mingw-flac tracking bugs for this issue:

Affects: fedora-all [bug 1573061]

Note You need to log in before you can comment on or make changes to this bug.