MGASA-2020-0480 - Updated flac packages fix security vulnerability Publication date: 29 Dec 2020 URL: https://advisories.mageia.org/MGASA-2020-0480.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-0499 In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation (CVE-2020-0499). References: - https://bugs.mageia.org/show_bug.cgi?id=27933 - https://lists.suse.com/pipermail/sle-security-updates/2020-December/008120.html - https://lists.opensuse.org/archives/list/[email protected]/thread/3IU5K7DTVB7RH7VVIUTMX4XFQDWSHYUS/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0499 SRPMS: - 7/core/flac-1.3.2-3.1.mga7
Mageia 2020-0480: flac security update
In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow
Summary
CVE: CVE-2020-0499
In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible
out of bounds read due to a heap buffer overflow. This could lead to remote
information disclosure with no additional execution privileges needed. User
interaction is needed for exploitation (CVE-2020-0499).
Resolution
MGASA-2020-0480 - Updated flac packages fix security vulnerability
References
- https://bugs.mageia.org/show_bug.cgi?id=27933
- https://lists.suse.com/pipermail/sle-security-updates/2020-December/008120.html
- https://lists.opensuse.org/archives/list/[email protected]/thread/3IU5K7DTVB7RH7VVIUTMX4XFQDWSHYUS/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0499
Severity
Issued Date: 29 Dec 2020
URL: https://advisories.mageia.org/MGASA-2020-0480.html
Type: security
Affected Mageia releases: 7
News
HOWTOs
Features
Secure Linux Hosting for Businesses
What Is Threat Intelligence?
CloudLinux Simplifies & Enhances Linux Security with its TuxCare Unified Enterprise Support Services
LinuxSecurity, Leading Provider of Linux Security News and Information, Unveils its New Website
Biden’s New Executive Cybersecurity Order Highlights the Power of Open-Source Security
About Us
Powered By
