CVE-2020-0499

In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070

In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070

FLAC stands for Free Lossless Audio Codec, an audio format similar to MP3, but lossless, meaning that audio is compressed in FLAC without any loss in quality.

Security Fix(es):

In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070(CVE-2020-0499)

In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070

In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation (CVE-2020-0499).

This update for flac fixes the following issues:

• CVE-2020-0487: Fixed a memory leak (bsc#1180112).
• CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).

This update was imported from the SUSE:SLE-15:Update update project.

This update for flac fixes the following issues:

• CVE-2020-0487: Fixed a memory leak (bsc#1180112).
• CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).

This update was imported from the SUSE:SLE-15:Update update project.

This update for vlc fixes the following issues:

• Update to version 3.0.18 (CVE-2022-41325, boo#1206142):
  • macOS: Fix audio device listing with non-latin names.
  • Misc: Fix rendering and performance issue with older GPUs.
  • Updated translations.
• Changes from version 3.0.18-rc2:
  • Codec/Demux:
    • Add support for Y16 chroma.
    • Fix build of gme plugin.
  • Lua:
    • Fix script for vocaroo.
    • Fix script for youtube to allow throttled playback.
  • Service Discovery: Fix UPnP regression on Windows.
  • Video Output: Fix video placement with caopengllayer.
  • Misc: Fix password search in kwallet module.
• Changes from version 3.0.18-rc:
  • Demux:
    • Major adaptive streaming update, notably for multiple timelies and webvtt.
    • Fix seeking with some fragmented MP4 files.
    • Add support for DVBSub inside MKV.
    • Fix some Flac files that could not be played.
    • Improve seeking in Ogg files.
  • Decoders:
    • Fix DxVA/D3D11 crashes on HEVC files with bogus references.
    • Fix libass storage size and crash.
    • Fix decoding errors on macOS hw decoding on some HEVC files.
  • Video Output:
    • Fix color regression with VAAPI/iOS and OpenGL output.
    • Fix some resizing issues with OpenGL on GLX/EGL/X11/XV.
    • Fix Direct3d9 texture stretching.
    • Fix 10-bit accelerated video filters on macOS.
  • Playlist: Avoid playlist liveloop on failed/tiny items (temporize EOS bursts).
  • Misc:
    • Misc fixes for the extension UI on macOS.
    • Improve SMBv1 and SMBv2 behaviours.
    • Improve FTP compatibility.
    • Support RISC-V.
    • Fix AVI muxing for Windows Media Player compatibility.
    • Fix seeking speed on macOS.

These are all security issues fixed in the flac-1.3.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libvlc5-3.0.17-1.1 package on the GA media of openSUSE Tumbleweed.

This update for flac fixes the following issues:

• CVE-2020-0487: Fixed a memory leak (bsc#1180112).
• CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).

This update for flac fixes the following issues:

• CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).

It was discovered that FLAC was not properly performing memory management operations, which could result in a memory leak. An attacker could possibly use this issue to cause FLAC to consume resources, leading to a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2017-6888)

It was discovered that FLAC was not properly performing bounds checking operations when decoding data. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to expose sensitive information or to cause FLAC to crash, leading to a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-0499)

It was discovered that FLAC was not properly performing bounds checking operations when encoding data. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to expose sensitive information or to cause FLAC to crash, leading to a denial of service. (CVE-2021-0561)