{"id":"CVE-2017-6888","aliases":["ALPINE-CVE-2017-6888","BELL-CVE-2017-6888","DEBIAN-CVE-2017-6888","DLA-2514-1","EUVD-2017-15942","GHSA-fmrx-65vg-qvjw","MGASA-2018-0227","SUSE-SU-2019:0920-1","UBUNTU-CVE-2017-6888","USN-5733-1","openSUSE-SU-2019:1225-1","openSUSE-SU-2024:10760-1"],"status":"published","title":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC...","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01336,"percentile":0.71427,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2018-04-25T21:00:00Z","modified":"2026-10-24T10:31:02Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"flac","fixed_in":["1.3.2-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"flac","fixed_in":["1.3.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flac","fixed_in":["1.3.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flac","fixed_in":["1.3.2-2"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"flac","fixed_in":["1.3.2-1.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"flac","fixed_in":["1.3.2-1.1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"flac","fixed_in":["1.3.2-3.3.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","fixed_in":["1.3.0-2ubuntu0.14.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","fixed_in":["1.3.1-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"flac","fixed_in":["1.3.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"flac","fixed_in":["1.3.2-lp150.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"flac","fixed_in":["1.3.3-1.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2+deb9u1"}]}],"versions":["1.3.2-1","1.3.2-2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1.1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.3.20"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.14.04.1+esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.3.0-2ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-4ubuntu0.1~esm1"}]}],"versions":["1.3.1-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.5-0ubuntu1","1.10.3-0ubuntu0.15.10.1","1.10.3-0ubuntu0.15.10.2","1.11.3-0ubuntu3","1.11.4-0ubuntu1","1.11.5-0ubuntu1","1.12.5-0ubuntu1","1.12.6-0ubuntu1","1.12.7-0ubuntu1","1.13.6-0ubuntu1","1.14.7-0ubuntu1","1.14.9-0ubuntu0.16.04.1","1.15.7-0ubuntu0.16.04.1","1.15.8-0ubuntu0.16.04.1","1.16.5-0ubuntu0.16.04.1","1.17.7-0ubuntu0.16.04.1","1.17.9-0ubuntu0.16.04.1","1.18.3-0ubuntu0.16.04.1","1.18.5-0ubuntu0.16.04.1","1.19.4-0ubuntu0.16.04.1","1.20.4-0ubuntu0.16.04.1","1.21.5-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"android","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20150818-1500-0ubuntu2","20150818-1500-0ubuntu3","20160307-0742-0ubuntu3","20160330-0939-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"praat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.16-1ubuntu2","6.0.4-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1ubuntu0.1"}]}],"versions":["1.3.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"praat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.30-3","6.0.37-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"praat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1-1","6.1.05-2","6.1.09-1","6.1.09-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"praat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.38-1","6.1.56-1","6.1.56-2","6.2.01-1","6.2.03-1","6.2.04-1","6.2.05-1","6.2.06-1","6.2.07-1","6.2.09-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"praat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.14-1","6.4.06+dfsg-1build1","6.4.06+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"praat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.27+dfsg-1","6.4.27+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"praat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.49+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"praat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.27+dfsg-2","6.4.46+dfsg-1","6.4.47+dfsg-1","6.4.48+dfsg-1","6.4.49+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.14.04.1+esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.3.0-2ubuntu0.14.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-4ubuntu0.1~esm1"}]}],"versions":["1.3.1-4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1ubuntu0.1"}]}],"versions":["1.3.2-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.3-1","1.3.3-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-2ubuntu0.1"}]}],"versions":["1.3.3-2","1.3.3-2build1","1.3.3-2build2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-lp150.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1.9"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"flac","product":"flac"},{"vendor":"flac_project","product":"flac"}],"references":[{"url":"https://secuniaresearch.flexerasoftware.com/advisories/82639/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://git.xiph.org/?p=flac.git%3Ba=commit%3Bh=4f47b63e9c971e6391590caf00a0f2a5ed612e67","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://secuniaresearch.flexerasoftware.com/secunia_research/2017-7/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33W6XZAAEJYRGU3XYHRO7XSYEA7YACUB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNZYTAU5UWBVXVJ4VHDWPR66ZVDLQZRE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6888"},{"url":"https://git.xiph.org/?p=flac.git;a=commit;h=4f47b63e9c971e6391590caf00a0f2a5ed612e67"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33W6XZAAEJYRGU3XYHRO7XSYEA7YACUB/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNZYTAU5UWBVXVJ4VHDWPR66ZVDLQZRE/"},{"url":"https://github.com/advisories/GHSA-fmrx-65vg-qvjw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-6888","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-6888","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-6888","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0227.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22984","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-05/msg00002.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190920-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1091045","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6888","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-6888","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5733-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-0499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-0561","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQDOX25M5VUOA47PHQ3CDEXFXRCYRFKC/#VQDOX25M5VUOA47PHQ3CDEXFXRCYRFKC","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-6888","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","status":"published","published":"2018-04-25T21:00:00Z","modified":"2024-08-05T15:41:17.756Z","updated_at":"2026-11-02T14:33:16.578111Z"}],"euvd":[{"id":"EUVD-2017-15942","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","status":"published","published":"2018-04-25T21:00:00Z","modified":"2024-08-05T15:41:17Z","updated_at":"2026-11-03T02:39:10.49179Z"}],"ghsa":[{"id":"GHSA-fmrx-65vg-qvjw","title":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC...","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","status":"published","published":"2022-05-13T01:11:38Z","modified":"2023-02-01T05:03:46Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:50:06.238998Z"}],"nvd":[{"id":"CVE-2017-6888","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","status":"published","published":"2018-04-25T21:29:00.217Z","modified":"2026-06-17T01:23:16.627Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"ALPINE-CVE-2017-6888","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","status":"published","published":"2018-04-25T21:29:00.217Z","modified":"2026-06-15T18:18:07.017829505Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2017-6888","title":"CVE-2017-6888 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:29.748183Z","modified":"2026-01-26T09:49:15.919846Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-6888","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","status":"published","published":"2018-04-25T21:29:00.217Z","modified":"2026-10-24T10:31:02.372570445Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-6888","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","status":"published","published":"2018-04-25T21:29:00.217Z","modified":"2026-09-01T20:03:49.546558778Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-6888","description":"An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.","status":"published","published":"2018-04-25T21:29:00Z","modified":"2026-10-17T12:53:25.463316155Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DLA-2514-1","title":"flac - security update","status":"published","published":"2021-01-04T00:00:00Z","modified":"2026-03-09T01:22:39.31522Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2018-0227","title":"Updated flac packages fix security vulnerability","description":"Memory leak in read_metadata_vorbiscomment_() function could lead to\ndenial of service (CVE-2017-6888).\n","status":"published","published":"2018-05-09T18:33:09Z","modified":"2026-04-16T06:23:16.029429733Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2019:1225-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2017-6888: An error in the 'read_metadata_vorbiscomment_()' function could be exploited to cause a memory leak via a specially crafted FLAC file (bsc#1091045).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-17T13:29:45Z","modified":"2025-05-07T18:09:46.831741Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10760-1","title":"flac-1.3.3-1.9 on GA media","description":"These are all security issues fixed in the flac-1.3.3-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:23:15.961991Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:0920-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2017-6888: An error in the 'read_metadata_vorbiscomment_()' function could be exploited to cause a memory leak via a specially crafted FLAC file (bsc#1091045).\n","status":"published","published":"2019-04-09T14:52:42Z","modified":"2026-02-04T03:30:23.478375Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-5733-1","title":"flac vulnerabilities","description":"It was discovered that FLAC was not properly performing memory management\noperations, which could result in a memory leak. An attacker could possibly\nuse this issue to cause FLAC to consume resources, leading to a denial of\nservice. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and\nUbuntu 18.04 LTS. (CVE-2017-6888)\n\nIt was discovered that FLAC was not properly performing bounds checking\noperations when decoding data. If a user or automated system were tricked\ninto processing a specially crafted file, an attacker could possibly use\nthis issue to expose sensitive information or to cause FLAC to crash,\nleading to a denial of service. This issue only affected Ubuntu 14.04 ESM,\nUbuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-0499)\n\nIt was discovered that FLAC was not properly performing bounds checking\noperations when encoding data. If a user or automated system were tricked\ninto processing a specially crafted file, an attacker could possibly use\nthis issue to expose sensitive information or to cause FLAC to crash,\nleading to a denial of service. (CVE-2021-0561)\n","status":"published","published":"2022-11-21T13:32:08Z","modified":"2026-06-29T13:50:42.75230737Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}