{"id":"CVE-2020-0487","aliases":["EUVD-2020-1985","GHSA-3h26-8wfg-f6vh","SUSE-SU-2020:3933-1","openSUSE-SU-2020:2348-1","openSUSE-SU-2020:2350-1"],"status":"rejected","title":"In read_metadata_vorbiscomment_ of stream_decoder.c, there is possible memory exhaustion due to a...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2020-12-15T15:55:54Z","modified":"2026-10-18T01:10:00Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-lp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-lp152.5.3.1"}]}],"bundled":2}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0487"},{"url":"https://source.android.com/security/bulletin/pixel/2020-12-01"},{"url":"https://github.com/advisories/GHSA-3h26-8wfg-f6vh"},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203933-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180099","tags":["report"]},{"url":"https://bugzilla.suse.com/1180112","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0499","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TWY2EXAD52MSG6ZRFPI2CF3APYF7OZ7F/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3IU5K7DTVB7RH7VVIUTMX4XFQDWSHYUS/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-0487","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none","status":"rejected","published":"2020-12-15T15:55:54Z","modified":"2021-01-21T21:28:07Z","updated_at":"2026-11-02T14:35:59.763887Z"}],"euvd":[{"id":"EUVD-2020-1985","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none","status":"published","published":"2020-12-15T15:55:54Z","modified":"2021-01-21T21:28:07Z","updated_at":"2026-11-03T03:51:19.215451Z"}],"ghsa":[{"id":"GHSA-3h26-8wfg-f6vh","title":"In read_metadata_vorbiscomment_ of stream_decoder.c, there is possible memory exhaustion due to a...","description":"In read_metadata_vorbiscomment_ of stream_decoder.c, there is possible memory exhaustion due to a memory leak. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124775381","status":"published","published":"2022-05-24T17:36:26Z","modified":"2023-01-29T05:05:42Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:45:51.307262Z"}],"nvd":[{"id":"CVE-2020-0487","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none","status":"rejected","published":"2020-12-15T16:15:13.917Z","modified":"2026-10-18T01:10:00.117Z","updated_at":"2026-11-02T14:06:27.73474Z"}],"osv":[{"id":"openSUSE-SU-2020:2348-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2020-0487: Fixed a memory leak (bsc#1180112).\n- CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-12-27T17:22:17Z","modified":"2026-02-04T02:27:48.309196Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2020:2350-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2020-0487: Fixed a memory leak (bsc#1180112).\n- CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-12-28T05:22:03Z","modified":"2026-02-04T03:16:33.208742Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"SUSE-SU-2020:3933-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2020-0487: Fixed a memory leak (bsc#1180112).\n- CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).\n","status":"published","published":"2020-12-24T11:36:42Z","modified":"2026-02-04T02:53:47.908951Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}