CVE-2021-0561

In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683

In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683

FLAC stands for Free Lossless Audio Codec, an audio format similar to MP3, but lossless, meaning that audio is compressed in FLAC without any loss in quality.

Security Fix(es):

In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683(CVE-2021-0561)

FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files.

Security Fix(es):

• flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c (CVE-2021-0561)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683

FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files.

Security Fix(es):

• flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c (CVE-2021-0561)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. (CVE-2021-0561)

This update for flac fixes the following issues:

• CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660).

This update for vlc fixes the following issues:

• Update to version 3.0.18 (CVE-2022-41325, boo#1206142):
  • macOS: Fix audio device listing with non-latin names.
  • Misc: Fix rendering and performance issue with older GPUs.
  • Updated translations.
• Changes from version 3.0.18-rc2:
  • Codec/Demux:
    • Add support for Y16 chroma.
    • Fix build of gme plugin.
  • Lua:
    • Fix script for vocaroo.
    • Fix script for youtube to allow throttled playback.
  • Service Discovery: Fix UPnP regression on Windows.
  • Video Output: Fix video placement with caopengllayer.
  • Misc: Fix password search in kwallet module.
• Changes from version 3.0.18-rc:
  • Demux:
    • Major adaptive streaming update, notably for multiple timelies and webvtt.
    • Fix seeking with some fragmented MP4 files.
    • Add support for DVBSub inside MKV.
    • Fix some Flac files that could not be played.
    • Improve seeking in Ogg files.
  • Decoders:
    • Fix DxVA/D3D11 crashes on HEVC files with bogus references.
    • Fix libass storage size and crash.
    • Fix decoding errors on macOS hw decoding on some HEVC files.
  • Video Output:
    • Fix color regression with VAAPI/iOS and OpenGL output.
    • Fix some resizing issues with OpenGL on GLX/EGL/X11/XV.
    • Fix Direct3d9 texture stretching.
    • Fix 10-bit accelerated video filters on macOS.
  • Playlist: Avoid playlist liveloop on failed/tiny items (temporize EOS bursts).
  • Misc:
    • Misc fixes for the extension UI on macOS.
    • Improve SMBv1 and SMBv2 behaviours.
    • Improve FTP compatibility.
    • Support RISC-V.
    • Fix AVI muxing for Windows Media Player compatibility.
    • Fix seeking speed on macOS.

These are all security issues fixed in the flac-1.3.4-1.1 package on the GA media of openSUSE Tumbleweed.

In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

This update for flac fixes the following issues:

• CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660).

This update for flac fixes the following issues:

• CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660).

It was discovered that FLAC was not properly performing memory management operations, which could result in a memory leak. An attacker could possibly use this issue to cause FLAC to consume resources, leading to a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2017-6888)

It was discovered that FLAC was not properly performing bounds checking operations when decoding data. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to expose sensitive information or to cause FLAC to crash, leading to a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-0499)

It was discovered that FLAC was not properly performing bounds checking operations when encoding data. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to expose sensitive information or to cause FLAC to crash, leading to a denial of service. (CVE-2021-0561)