USN-5733-1: FLAC vulnerabilities

Severity

Low

Vendor

Canonical Ubuntu

Description

It was discovered that FLAC was not properly performing memory management operations, which could result in a memory leak. An attacker could possibly use this issue to cause FLAC to consume resources, leading to a denial of service. (CVE-2017-6888) It was discovered that FLAC was not properly performing bounds checking operations when encoding or decoding data. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to expose sensitive information or to cause FLAC to crash, leading to a denial of service. (CVE-2020-0499, CVE-2021-0561) Update Instructions: Run `sudo pro fix USN-5733-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libflac-doc – 1.3.1-4ubuntu0.1~esm1 libflac-dev – 1.3.1-4ubuntu0.1~esm1 libflac++-dev – 1.3.1-4ubuntu0.1~esm1 flac – 1.3.1-4ubuntu0.1~esm1 libflac++6v5 – 1.3.1-4ubuntu0.1~esm1 libflac8 – 1.3.1-4ubuntu0.1~esm1 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

CVEs contained in this USN include: CVE-2017-6888, CVE-2020-0499, CVE-2021-0561.

Affected Cloud Foundry Products and Versions

Severity is low unless otherwise noted.

• cflinuxfs3
  • All versions prior to 0.337.0
• CF Deployment
  • All versions prior to 23.3.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• cflinuxfs3
  • Upgrade all versions to 0.337.0 or greater
• CF Deployment
  • Upgrade all versions to 23.3.0 or greater

History

2022-12-07: Initial vulnerability report published.