CVE-2017-6888
CVE-2017-6888
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.
CVSS 5.5 · Medium · EPSS 1.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
flac
- Versions
- 1.3.2: Affected
No fix published
flac Debian:12
- Affected ranges
- ECOSYSTEM: < 1.3.2-2
Update to 1.3.2-2
flac Debian:13
- Affected ranges
- ECOSYSTEM: < 1.3.2-2
Update to 1.3.2-2
flac Debian:14
- Affected ranges
- ECOSYSTEM: < 1.3.2-2
Update to 1.3.2-2
flac Ubuntu:Pro:14.04:LTS
- Versions
- 1.3.0-1
- 1.3.0-2
- 1.3.0-2ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 1.3.0-2ubuntu0.14.04.1+esm1
Update to 1.3.0-2ubuntu0.14.04.1+esm1
flac Ubuntu:Pro:16.04:LTS
- Versions
- 1.3.1-4
- Affected ranges
- ECOSYSTEM: < 1.3.1-4ubuntu0.1~esm1
Update to 1.3.1-4ubuntu0.1~esm1
oxide-qt Ubuntu:16.04:LTS
- Versions
- 1.9.5-0ubuntu1
- 1.10.3-0ubuntu0.15.10.1
- 1.10.3-0ubuntu0.15.10.2
- 1.11.3-0ubuntu3
- 1.11.4-0ubuntu1
- 1.11.5-0ubuntu1
- 1.12.5-0ubuntu1
- 1.12.6-0ubuntu1
- 1.12.7-0ubuntu1
- 1.13.6-0ubuntu1
- 1.14.7-0ubuntu1
- 1.14.9-0ubuntu0.16.04.1
- 1.15.7-0ubuntu0.16.04.1
- 1.15.8-0ubuntu0.16.04.1
- 1.16.5-0ubuntu0.16.04.1
- 1.17.7-0ubuntu0.16.04.1
- 1.17.9-0ubuntu0.16.04.1
- 1.18.3-0ubuntu0.16.04.1
- 1.18.5-0ubuntu0.16.04.1
- 1.19.4-0ubuntu0.16.04.1
- 1.20.4-0ubuntu0.16.04.1
- 1.21.5-0ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
android Ubuntu:16.04:LTS
- Versions
- 20150818-1500-0ubuntu2
- 20150818-1500-0ubuntu3
- 20160307-0742-0ubuntu3
- 20160330-0939-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
praat Ubuntu:16.04:LTS
- Versions
- 5.3.16-1ubuntu2
- 6.0.4-2ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
flac Ubuntu:18.04:LTS
- Versions
- 1.3.2-1
- Affected ranges
- ECOSYSTEM: < 1.3.2-1ubuntu0.1
Update to 1.3.2-1ubuntu0.1
praat Ubuntu:18.04:LTS
- Versions
- 6.0.30-3
- 6.0.37-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
praat Ubuntu:20.04:LTS
- Versions
- 6.1-1
- 6.1.05-2
- 6.1.09-1
- 6.1.09-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
praat Ubuntu:22.04:LTS
- Versions
- 6.1.38-1
- 6.1.56-1
- 6.1.56-2
- 6.2.01-1
- 6.2.03-1
- 6.2.04-1
- 6.2.05-1
- 6.2.06-1
- 6.2.07-1
- 6.2.09-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
praat Ubuntu:24.04:LTS
- Versions
- 6.3.14-1
- 6.4.06+dfsg-1build1
- 6.4.06+dfsg-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
praat Ubuntu:25.10
- Versions
- 6.4.27+dfsg-1
- 6.4.27+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
praat Ubuntu:26.10
- Versions
- 6.4.49+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
praat Ubuntu:26.04:LTS
- Versions
- 6.4.27+dfsg-2
- 6.4.46+dfsg-1
- 6.4.47+dfsg-1
- 6.4.48+dfsg-1
- 6.4.49+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://secuniaresearch.flexerasoftware.com/advisories/82639/
- https://git.xiph.org/?p=flac.git%3Ba=commit%3Bh=4f47b63e9c971e6391590caf00a0f2a5ed612e67
- https://secuniaresearch.flexerasoftware.com/secunia_research/2017-7/
- https://lists.debian.org/debian-lts-announce/2021/01/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33W6XZAAEJYRGU3XYHRO7XSYEA7YACUB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNZYTAU5UWBVXVJ4VHDWPR66ZVDLQZRE/
- https://nvd.nist.gov/vuln/detail/CVE-2017-6888