Advisories » MGASA-2014-0499

Updated flac packages fix security vulnerabilities

Publication date: 29 Nov 2014
Modification date: 29 Nov 2014
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-8962 , CVE-2014-9028

Description

In libFLAC before 1.3.1, a stack overflow (CVE-2014-8962) and a heap overflow
(CVE-2014-9028), which may result in arbitrary code execution, can be
triggered by passing a maliciously crafted .flac file to the libFLAC decoder.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=14658
• http://www.ocert.org/advisories/ocert-2014-008.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8962
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9028

SRPMS

4/core

• flac-1.3.0-2.1.mga4