Vulnerability · Published Aug 22, 2023 · Assigned by mitre
CVE-2020-22219
High 7.8
In plain English
A high-severity security flaw in the flac package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.8%top 43.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | flac | 1.3.2-9.el8_8.1 | ALSA-2023:5046 |
| AlmaLinux:9 | flac | 1.3.3-10.el9_2.1 | ALSA-2023:5048 |
| AlmaLinux:8 | flac-devel | 1.3.2-9.el8_8.1 | ALSA-2023:5046 |
| AlmaLinux:9 | flac-devel | 1.3.3-10.el9_2.1 | ALSA-2023:5048 |
| AlmaLinux:8 | flac-libs | 1.3.2-9.el8_8.1 | ALSA-2023:5046 |
| AlmaLinux:9 | flac-libs | 1.3.3-10.el9_2.1 | ALSA-2023:5048 |
| Debian:12 | flac | 1.4.1-1 | DEBIAN-CVE-2020-22219 |
| Debian:13 | flac | 1.4.1-1 | DEBIAN-CVE-2020-22219 |
| Debian:14 | flac | 1.4.1-1 | DEBIAN-CVE-2020-22219 |
| Rocky Linux:9 | flac | 0:1.3.3-10.el9_2.1 | RLSA-2023:5048 |
| Ubuntu:22.04:LTS | flac | 1.3.3-2ubuntu0.2 | USN-6360-1 |
| Ubuntu:22.04:LTS | flac | 1.3.3-2ubuntu0.2 | UBUNTU-CVE-2020-22219 |
Affected products (as reported)
References
- https://github.com/xiph/flac/issues/215
- FEDORA-2023-bf8423a373 vendor-advisory
- DSA-5500 vendor-advisory
- [debian-lts-announce] 20230925 [SECURITY] [DLA 3581-1] flac security update mailing-list