Memory leak in FLAC - CVE-2017-6888

Vulnerability identifier: #VU12888

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-6888

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the "read_metadata_vorbiscomment_()" function in src/libFLAC/stream_decoder.c due to memory leak. A remote attacker can trick the victim into opening a specially crafted FLAC file and cause the service to crash.

FLAC
flac (Alpine package)
libflac++6 (Ubuntu package)
flac (Ubuntu package)
libflac8 (Ubuntu package)
libflac++6v5 (Ubuntu package)
flac
mingw-flac
Zend Server
Ubuntu
Opensuse
Fedora
cflinuxfs3

Install update from vendor's website.

flac (Alpine package) - update to 1.3.2-r2
libflac++6 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
flac (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.3.2-1ubuntu0.1, 1.3.3-1ubuntu0.1, 1.3.3-2ubuntu0.1
libflac8 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.3.2-1ubuntu0.1, 1.3.3-1ubuntu0.1, 1.3.3-2ubuntu0.1
libflac++6v5 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.3.2-1ubuntu0.1, 1.3.3-1ubuntu0.1, 1.3.3-2ubuntu0.1
cflinuxfs3 - update to 0.337.0
flac - addressed in versions 1.3.2-7.fc27, 1.3.2-7.fc28
mingw-flac - addressed in versions 1.3.3-1.fc32, 1.3.3-1.fc33

• https://secuniaresearch.flexerasoftware.com/secunia_research/2017-7/

• Denial of service in FLAC
• OpenSUSE Linux update for flac
• Memory leak in flac (Alpine package)
• Ubuntu update for flac
• Cloud Foundry Foundation cflinuxfs3 update for kernel
• Fedora 33 update for mingw-flac
• Fedora 32 update for mingw-flac
• Fedora 27 update for flac
• Fedora 28 update for flac