Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
202
security advisorybuffer overflowsoftware patchopenSUSE: 2023:3678-1 Moderate: MP3 Decoder Buffer Overflow Resolution
This update for flac fixes the following issues: CVE-2020-22219: Fixed a buffer overflow in function bitwriter_grow_ which might allow a remote attacker to run arbitrary code via crafted input to the. # Security update for flac Announcement ID: SUSE-SU-2023:3635-1 Rating: moderate References: * #1214615 Cross-References: * CVE-2020-22219 CVSS scores: * CVE-2020-22219 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2020-22219 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for flac fixes the following issues: * CVE-2020-22219: Fixed a buffer overflow in function bitwriter_grow_ which might allow a remote attacker to run arbitrary code via crafted input to the encoder. (bsc#1214615) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3635=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3635=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3635=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3635=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3635=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3635=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3635=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3635=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3635=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * flac-devel-1.3.2-150000.3.14.1 * libFLAC8-debuginfo-1.3.2-150000.3.14.1 * flac-1.3.2-150000.3.14.1 * libFLAC8-1.3.2-150000.3.14.1 * libFLAC++6-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * flac-debugsource-1.3.2-150000.3.14.1 * libFLAC++6-debuginfo-1.3.2-150000.3.14.1 * openSUSE Leap 15.4 (x86_64) * flac-devel-32bit-1.3.2-150000.3.14.1 * libFLAC++6-32bit-1.3.2-150000.3.14.1 * libFLAC++6-32bit-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-32bit-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-32bit-1.3.2-150000.3.14.1 * openSUSE Leap 15.4 (noarch) * flac-doc-1.3.2-150000.3.14.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * flac-devel-1.3.2-150000.3.14.1 * libFLAC8-debuginfo-1.3.2-150000.3.14.1 * flac-1.3.2-150000.3.14.1 * libFLAC8-1.3.2-150000.3.14.1 * libFLAC++6-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * flac-debugsource-1.3.2-150000.3.14.1 * libFLAC++6-debuginfo-1.3.2-150000.3.14.1 * openSUSE Leap 15.5(x86_64) * flac-devel-32bit-1.3.2-150000.3.14.1 * libFLAC++6-32bit-1.3.2-150000.3.14.1 * libFLAC++6-32bit-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-32bit-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-32bit-1.3.2-150000.3.14.1 * openSUSE Leap 15.5 (noarch) * flac-doc-1.3.2-150000.3.14.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * flac-devel-1.3.2-150000.3.14.1 * libFLAC8-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-1.3.2-150000.3.14.1 * libFLAC++6-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * flac-debugsource-1.3.2-150000.3.14.1 * libFLAC++6-debuginfo-1.3.2-150000.3.14.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * flac-devel-1.3.2-150000.3.14.1 * libFLAC8-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-1.3.2-150000.3.14.1 * libFLAC++6-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * flac-debugsource-1.3.2-150000.3.14.1 * libFLAC++6-debuginfo-1.3.2-150000.3.14.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64) * flac-debugsource-1.3.2-150000.3.14.1 * flac-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * SUSE Package Hub 15 15-SP4 (x86_64) * libFLAC8-32bit-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-32bit-1.3.2-150000.3.14.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * flac-debugsource-1.3.2-150000.3.14.1 * flac-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * SUSE Package Hub 15 15-SP5 (x86_64) * libFLAC8-32bit-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-32bit-1.3.2-150000.3.14.1 * SUSE Manager Proxy 4.2 (x86_64) * flac-devel-1.3.2-150000.3.14.1 * libFLAC8-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-1.3.2-150000.3.14.1 * libFLAC++6-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * flac-debugsource-1.3.2-150000.3.14.1 * libFLAC++6-debuginfo-1.3.2-150000.3.14.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * flac-devel-1.3.2-150000.3.14.1 *libFLAC8-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-1.3.2-150000.3.14.1 * libFLAC++6-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * flac-debugsource-1.3.2-150000.3.14.1 * libFLAC++6-debuginfo-1.3.2-150000.3.14.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * flac-devel-1.3.2-150000.3.14.1 * libFLAC8-debuginfo-1.3.2-150000.3.14.1 * libFLAC8-1.3.2-150000.3.14.1 * libFLAC++6-1.3.2-150000.3.14.1 * flac-debuginfo-1.3.2-150000.3.14.1 * flac-debugsource-1.3.2-150000.3.14.1 * libFLAC++6-debuginfo-1.3.2-150000.3.14.1 ## References: * https://www.suse.com/security/cve/CVE-2020-22219.html * https://bugzilla.suse.com/show_bug.cgi?id=1214615 . A new security patch for Flac addresses problems linked to buffer overflow vulnerabilities and includes detailed guidance for openSUSE users on how to apply the update.. Flac Security Fix, buffer Overflow Issue, openSUSE Patch Instructions. . LinuxSecurity.com Team
Sep 18, 2023
OpenSUSE
217
security advisorysecurity updatesoftware patchOracle Linux 8 ELSA-2023-5046 Important Memory Fix for Flac
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2023-5046 https://linux.oracle.com/errata/ELSA-2023-5046.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: flac-libs-1.3.2-9.el8_8.1.i686.rpm flac-libs-1.3.2-9.el8_8.1.x86_64.rpm flac-1.3.2-9.el8_8.1.x86_64.rpm flac-devel-1.3.2-9.el8_8.1.i686.rpm flac-devel-1.3.2-9.el8_8.1.x86_64.rpm aarch64: flac-libs-1.3.2-9.el8_8.1.aarch64.rpm flac-1.3.2-9.el8_8.1.aarch64.rpm flac-devel-1.3.2-9.el8_8.1.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol8/SRPMS-updates//flac-1.3.2-9.el8_8.1.src.rpm Related CVEs: CVE-2020-22219 Description of changes: [1.3.2-9.el8_8.1] - don't free memory that is still used after realloc() error (CVE-2020-22219) _______________________________________________ El-errata mailing list
Sep 14, 2023
•Important
Oracle
98
security advisorycriticalremote code executionRedHat: RHSA-2023-5047-01 Critical: Flac Remote Code Execution Risk
An update for flac is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: flac security update Advisory ID: RHSA-2023:5047-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5047 Issue date: 2023-09-11 CVE Names: CVE-2020-22219 ===================================================================== 1. Summary: An update for flac is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64 3. Description: FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder (CVE-2020-22219) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes thechanges described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2235489 - CVE-2020-22219 flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder 6. Package List: Red Hat Enterprise Linux AppStream EUS (v.9.0): Source: flac-1.3.3-9.el9_0.1.src.rpm aarch64: flac-debuginfo-1.3.3-9.el9_0.1.aarch64.rpm flac-debugsource-1.3.3-9.el9_0.1.aarch64.rpm flac-libs-1.3.3-9.el9_0.1.aarch64.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.aarch64.rpm ppc64le: flac-debuginfo-1.3.3-9.el9_0.1.ppc64le.rpm flac-debugsource-1.3.3-9.el9_0.1.ppc64le.rpm flac-libs-1.3.3-9.el9_0.1.ppc64le.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.ppc64le.rpm s390x: flac-debuginfo-1.3.3-9.el9_0.1.s390x.rpm flac-debugsource-1.3.3-9.el9_0.1.s390x.rpm flac-libs-1.3.3-9.el9_0.1.s390x.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.s390x.rpm x86_64: flac-debuginfo-1.3.3-9.el9_0.1.i686.rpm flac-debuginfo-1.3.3-9.el9_0.1.x86_64.rpm flac-debugsource-1.3.3-9.el9_0.1.i686.rpm flac-debugsource-1.3.3-9.el9_0.1.x86_64.rpm flac-libs-1.3.3-9.el9_0.1.i686.rpm flac-libs-1.3.3-9.el9_0.1.x86_64.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.i686.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.x86_64.rpm Red Hat CodeReady Linux Builder EUS(v.9.0): aarch64: flac-1.3.3-9.el9_0.1.aarch64.rpm flac-debuginfo-1.3.3-9.el9_0.1.aarch64.rpm flac-debugsource-1.3.3-9.el9_0.1.aarch64.rpm flac-devel-1.3.3-9.el9_0.1.aarch64.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.aarch64.rpm ppc64le: flac-1.3.3-9.el9_0.1.ppc64le.rpm flac-debuginfo-1.3.3-9.el9_0.1.ppc64le.rpm flac-debugsource-1.3.3-9.el9_0.1.ppc64le.rpm flac-devel-1.3.3-9.el9_0.1.ppc64le.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.ppc64le.rpm s390x: flac-1.3.3-9.el9_0.1.s390x.rpm flac-debuginfo-1.3.3-9.el9_0.1.s390x.rpm flac-debugsource-1.3.3-9.el9_0.1.s390x.rpm flac-devel-1.3.3-9.el9_0.1.s390x.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.s390x.rpm x86_64: flac-1.3.3-9.el9_0.1.x86_64.rpm flac-debuginfo-1.3.3-9.el9_0.1.i686.rpm flac-debuginfo-1.3.3-9.el9_0.1.x86_64.rpm flac-debugsource-1.3.3-9.el9_0.1.i686.rpm flac-debugsource-1.3.3-9.el9_0.1.x86_64.rpm flac-devel-1.3.3-9.el9_0.1.i686.rpm flac-devel-1.3.3-9.el9_0.1.x86_64.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.i686.rpm flac-libs-debuginfo-1.3.3-9.el9_0.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-22219 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIcBAEBCAAGBQJk/2W0AAoJENzjgjWX9erEVtsQAKPL1XQYvc7K3DR2tWLr1D+O /RWQUK7EmUTP1GRrD0wNt/n1nuZS2/F0ZiKdITNIqPqmHigcYIOB9ztcee8gvfOK +fVek5h/tpHAK5KlEd4dVBbPio4SB9Z4oy0u51KMToFqGWNYfJRvrm4sUv5/RDiG Z4re1WVpYiiWkGxL9I5c+U1m7mKoZYmeirv/N3Uk3jygJgNHuW2qF3JpoiHN/o1N AMJUEChM4FDG3KZ/aEtTb42JDOXBeJqc3H316zgrk0cGIRC3tKcEc0PynikVykMe EAEpCfVRL2CRGhqM2//KG+ddt/cm4rUwk5BeLX3+d9Kz+/XAqrk6e3nvpoMahmfl F3lp7yqSxbPbVU+s2cEwF3bTQKLYlEVXzvtqWTx4byNXwj88N7cmeH6kAeD2kk3B 7pV30urIIvNgN4Ai3M5Ff8X5wQaVC1N0O4DFaqMGwJMc6MP+e8qdeEM6BgTKFddL 8vcFkC4UWnDNRYEx0m2IahbxPL+5VUrE9oODf9qcb7a6qdrlHscHEXtvZNVchxEx WM25p8rneBpWGF+gMO2YnB9iPDPK2qsq2tnWtquonGVbBTG6IfgYpbWBkUszDPYF a1VPbaLNP5LtyBnAJmkWnU5T3Rm9FIlQf5ICF/weWgMfjwhyFvaiQoldgREULxwE ZfIX7D1YfTjGcpruvlYH =eQDr -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 11, 2023
•Important
Red Hat
98
security advisoryremote code executionRed Hat Enterprise LinuxRed Hat Enterprise Linux 8.6 RHSA-2023-5045-01 Important Flac RCE Fix
An update for flac is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: flac security update Advisory ID: RHSA-2023:5045-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5045 Issue date: 2023-09-11 CVE Names: CVE-2020-22219 ===================================================================== 1. Summary: An update for flac is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder EUS (v.8.6) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream EUS (v.8.6) - aarch64, ppc64le, s390x, x86_64 3. Description: FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder (CVE-2020-22219) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes thechanges described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2235489 - CVE-2020-22219 flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder 6. Package List: Red Hat Enterprise Linux AppStream EUS (v.8.6): Source: flac-1.3.2-9.el8_6.1.src.rpm aarch64: flac-debuginfo-1.3.2-9.el8_6.1.aarch64.rpm flac-debugsource-1.3.2-9.el8_6.1.aarch64.rpm flac-libs-1.3.2-9.el8_6.1.aarch64.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.aarch64.rpm ppc64le: flac-debuginfo-1.3.2-9.el8_6.1.ppc64le.rpm flac-debugsource-1.3.2-9.el8_6.1.ppc64le.rpm flac-libs-1.3.2-9.el8_6.1.ppc64le.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.ppc64le.rpm s390x: flac-debuginfo-1.3.2-9.el8_6.1.s390x.rpm flac-debugsource-1.3.2-9.el8_6.1.s390x.rpm flac-libs-1.3.2-9.el8_6.1.s390x.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.s390x.rpm x86_64: flac-debuginfo-1.3.2-9.el8_6.1.i686.rpm flac-debuginfo-1.3.2-9.el8_6.1.x86_64.rpm flac-debugsource-1.3.2-9.el8_6.1.i686.rpm flac-debugsource-1.3.2-9.el8_6.1.x86_64.rpm flac-libs-1.3.2-9.el8_6.1.i686.rpm flac-libs-1.3.2-9.el8_6.1.x86_64.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.i686.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.x86_64.rpm Red Hat CodeReady Linux Builder EUS(v.8.6): aarch64: flac-1.3.2-9.el8_6.1.aarch64.rpm flac-debuginfo-1.3.2-9.el8_6.1.aarch64.rpm flac-debugsource-1.3.2-9.el8_6.1.aarch64.rpm flac-devel-1.3.2-9.el8_6.1.aarch64.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.aarch64.rpm ppc64le: flac-1.3.2-9.el8_6.1.ppc64le.rpm flac-debuginfo-1.3.2-9.el8_6.1.ppc64le.rpm flac-debugsource-1.3.2-9.el8_6.1.ppc64le.rpm flac-devel-1.3.2-9.el8_6.1.ppc64le.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.ppc64le.rpm s390x: flac-1.3.2-9.el8_6.1.s390x.rpm flac-debuginfo-1.3.2-9.el8_6.1.s390x.rpm flac-debugsource-1.3.2-9.el8_6.1.s390x.rpm flac-devel-1.3.2-9.el8_6.1.s390x.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.s390x.rpm x86_64: flac-1.3.2-9.el8_6.1.x86_64.rpm flac-debuginfo-1.3.2-9.el8_6.1.i686.rpm flac-debuginfo-1.3.2-9.el8_6.1.x86_64.rpm flac-debugsource-1.3.2-9.el8_6.1.i686.rpm flac-debugsource-1.3.2-9.el8_6.1.x86_64.rpm flac-devel-1.3.2-9.el8_6.1.i686.rpm flac-devel-1.3.2-9.el8_6.1.x86_64.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.i686.rpm flac-libs-debuginfo-1.3.2-9.el8_6.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-22219 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIcBAEBCAAGBQJk/2WxAAoJENzjgjWX9erEOXsP/0lMVJOTkfVKKgY9KLp+VH3T k4hTVaEJKIT2hl9twoFNZpS6QIAIRy5qJ9J7g4LgC25H5cWi+6ELFcvUXhwdwiFL vvvQtLwCjjzGfO2aJA4fhBkUTYIpprgIolfWBXi1TVLmeJsNRevm6EGEz08fsAKI UV22rjOX4o5AWymTdvUHGQTeGmpAIAAwmskvEh6s/i+5v+8fhXjVUeXolNRstW8Z kkrNYcAYDHWIMLdnuQr+MjxUusU4C9G1trDIcL61ABEZIdOEdLh0rfOmaSOBGGEM NYpBlDzEtfHbtI17WUfVjwe5Huo7P+N3P3oGeEQk56TUvXSP+saqjV8EJsU4dck9 K4gQCePTK/jtavhFXLlj28Vlp0dg60gVZk5pD2jJc3mIbXC0qC9CGMz0Q6dJTBs5 K4lMp1x25fFktl2d5Ch2j3tpTkMy3FZw5Xe5ZEm88RhZEISkJjxedPSE4W/LGvDL pagrh6VChmRHU9CJORlSWUhec6S72BAaekKdM6O8ZtTL2ed8TQH4ZbJzIX/AGWEP ohDllbhMf92XcmCXK2vxxLD757NxFkYuKN+PT/0Ryk1IZIaZJ0apHSphw3OCNQMa piOS11OCn6aMVnXRFGnQKTXkhEb9MZy/3VswpX6dGhdVuiuzVU0TZ9xZIianPstv hTU1rb/UzGFlbmQMD1Rm =N6/A -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 11, 2023
•Important
Red Hat
98
security advisoryremote code executionred hat enterpriseRed Hat Enterprise Linux 9: RHSA-2023-5048-01 Critical: FLAC RCE Issue
An update for flac is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: flac security update Advisory ID: RHSA-2023:5048-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5048 Issue date: 2023-09-11 CVE Names: CVE-2020-22219 ===================================================================== 1. Summary: An update for flac is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux CRB (v. 9) - aarch64, ppc64le, s390x, x86_64 3. Description: FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder (CVE-2020-22219) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, whichincludes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2235489 - CVE-2020-22219 flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder 6. Package List: Red Hat Enterprise Linux AppStream (v. 9): Source: flac-1.3.3-10.el9_2.1.src.rpm aarch64: flac-debuginfo-1.3.3-10.el9_2.1.aarch64.rpm flac-debugsource-1.3.3-10.el9_2.1.aarch64.rpm flac-libs-1.3.3-10.el9_2.1.aarch64.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.aarch64.rpm ppc64le: flac-debuginfo-1.3.3-10.el9_2.1.ppc64le.rpm flac-debugsource-1.3.3-10.el9_2.1.ppc64le.rpm flac-libs-1.3.3-10.el9_2.1.ppc64le.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.ppc64le.rpm s390x: flac-debuginfo-1.3.3-10.el9_2.1.s390x.rpm flac-debugsource-1.3.3-10.el9_2.1.s390x.rpm flac-libs-1.3.3-10.el9_2.1.s390x.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.s390x.rpm x86_64: flac-debuginfo-1.3.3-10.el9_2.1.i686.rpm flac-debuginfo-1.3.3-10.el9_2.1.x86_64.rpm flac-debugsource-1.3.3-10.el9_2.1.i686.rpm flac-debugsource-1.3.3-10.el9_2.1.x86_64.rpm flac-libs-1.3.3-10.el9_2.1.i686.rpm flac-libs-1.3.3-10.el9_2.1.x86_64.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.i686.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.x86_64.rpm Red Hat Enterprise Linux CRB (v.9): aarch64: flac-1.3.3-10.el9_2.1.aarch64.rpm flac-debuginfo-1.3.3-10.el9_2.1.aarch64.rpm flac-debugsource-1.3.3-10.el9_2.1.aarch64.rpm flac-devel-1.3.3-10.el9_2.1.aarch64.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.aarch64.rpm ppc64le: flac-1.3.3-10.el9_2.1.ppc64le.rpm flac-debuginfo-1.3.3-10.el9_2.1.ppc64le.rpm flac-debugsource-1.3.3-10.el9_2.1.ppc64le.rpm flac-devel-1.3.3-10.el9_2.1.ppc64le.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.ppc64le.rpm s390x: flac-1.3.3-10.el9_2.1.s390x.rpm flac-debuginfo-1.3.3-10.el9_2.1.s390x.rpm flac-debugsource-1.3.3-10.el9_2.1.s390x.rpm flac-devel-1.3.3-10.el9_2.1.s390x.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.s390x.rpm x86_64: flac-1.3.3-10.el9_2.1.x86_64.rpm flac-debuginfo-1.3.3-10.el9_2.1.i686.rpm flac-debuginfo-1.3.3-10.el9_2.1.x86_64.rpm flac-debugsource-1.3.3-10.el9_2.1.i686.rpm flac-debugsource-1.3.3-10.el9_2.1.x86_64.rpm flac-devel-1.3.3-10.el9_2.1.i686.rpm flac-devel-1.3.3-10.el9_2.1.x86_64.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.i686.rpm flac-libs-debuginfo-1.3.3-10.el9_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-22219 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIcBAEBCAAGBQJk/2WhAAoJENzjgjWX9erE3DYP+wS27lw358et2AX5osfA6VS8 E/1q3v2t/JoCafeDq18wz0scuio5KLVdzxxxv+LJy/bozmkLhyKXIEqj2tTrQF4p /m27rDypksancVGZClu8GhO1fexyzzywhPO1jVdRRzbvL2cbDLoSy1aUL09m8fyf bQCSMtIUIi2GB0j/o2ANU6kGZNeVLIZzN3sBeh+UPCRRWKeazPt1aIgw/X7Lp9Fj HWY2lpSz11SHNYfi+w8zueDREcRrK27K9+IEEtZmYntWJ1HIHucGTFmo3phM80fL RPFeUDQTc9/T+opHXaXgqwXGm2F9h1+UCNhXn8Ce81diTOthGQqA7hn1o1AfPJEw CAcyYZC6koez06KkX8MC4nTpSSBaGZg3qQawYEd/Fvv8AKyrqdQ8j+SW91rro87i BV8unUKfk/85ae/4z+zxDGAEwKqGF1Oq0IkZNPHGw6pyRXXtn8y2zpTGROd6Ovce nVLVr1OP9rUdPJ5LQkr6AC0avwRNakOTaoqxrIrS8ZWho436w44+Q2ba3uHbP/t+ 1JG2w+ckAw8eU9bzY5k9i0yjeTYBDJfAC9FLSjc+MkzbUh+jtS+ODIOch6Ef0zqY nVjvrOI4a9p/giLKEnJJA851tQ4Pik7/KtJx0mE81I4ibBNOYbqHtWEDQA42tDPN 1c72yatovuF8qIjLkBbY =s/9A -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 11, 2023
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!