Skip to content
OpenAdvisories
Unscored USN-2426-1 2 CVEs

flac vulnerabilities

Published Nov 27, 2014 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Michele Spagnuolo discovered that FLAC incorrectly handled certain
malformed audio files. An attacker could use this issue to cause FLAC to
crash, resulting in a denial of service, or possibly execute arbitrary
code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS flac 1.3.0-2ubuntu0.14.04.1

Vulnerabilities 2

  • Unscored —
    CVE-2014-8962

    Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary co…

    flac flac Debian Ubuntu
  • Unscored —
    CVE-2014-9028

    Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary cod…

    flac flac Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-8962
  • report
    https://ubuntu.com/security/CVE-2014-9028