{"id":"CVE-2020-0499","aliases":["ALPINE-CVE-2020-0499","BELL-CVE-2020-0499","DEBIAN-CVE-2020-0499","DLA-2514-1","EUVD-2020-1997","GHSA-qp4c-cv95-gwhh","MGASA-2020-0480","OESA-2022-1697","SUSE-SU-2020:3933-1","SUSE-SU-2021:0017-1","UBUNTU-CVE-2020-0499","USN-5733-1","openSUSE-SU-2020:2348-1","openSUSE-SU-2020:2350-1","openSUSE-SU-2022:10252-1","openSUSE-SU-2024:11885-1","openSUSE-SU-2024:11951-1"],"status":"published","title":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read...","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04075,"percentile":0.90769,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-12-15T15:58:18Z","modified":"2026-10-26T12:01:11Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"flac","fixed_in":["1.3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flac","fixed_in":["1.3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flac","fixed_in":["1.3.3-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"flac","fixed_in":["1.3.2-3.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"flac","fixed_in":["1.3.3-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"flac","fixed_in":["1.3.3-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"flac","fixed_in":["1.3.3-6.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"flac","fixed_in":["1.3.0-12.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","fixed_in":["1.3.0-2ubuntu0.14.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","fixed_in":["1.3.1-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"flac","fixed_in":["1.3.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"flac","fixed_in":["1.3.3-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"vlc","fixed_in":["3.0.17-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2+deb9u1"}]}],"versions":["1.3.2-1","1.3.2-2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-6.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-12.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.14.04.1+esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.3.0-2ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-4ubuntu0.1~esm1"}]}],"versions":["1.3.1-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1ubuntu0.1"}]}],"versions":["1.3.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.3-1","1.3.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.14.04.1+esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.3.0-2ubuntu0.14.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-4ubuntu0.1~esm1"}]}],"versions":["1.3.1-4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1ubuntu0.1"}]}],"versions":["1.3.2-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.3-1","1.3.3-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-2ubuntu0.1"}]}],"versions":["1.3.3-2","1.3.3-2build1","1.3.3-2build2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-lp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-lp152.5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-bp153.2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-bp153.2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.17-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/security/bulletin/pixel/2020-12-01","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPA5GAEKPXKAHGHHBI4X7AFNI4BMOVG3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33W6XZAAEJYRGU3XYHRO7XSYEA7YACUB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNZYTAU5UWBVXVJ4VHDWPR66ZVDLQZRE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0499","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33W6XZAAEJYRGU3XYHRO7XSYEA7YACUB/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNZYTAU5UWBVXVJ4VHDWPR66ZVDLQZRE/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VPA5GAEKPXKAHGHHBI4X7AFNI4BMOVG3/"},{"url":"https://github.com/advisories/GHSA-qp4c-cv95-gwhh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-0499","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-0499","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-0499","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0480.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27933","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2020-December/008120.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3IU5K7DTVB7RH7VVIUTMX4XFQDWSHYUS/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1697","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203933-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180099","tags":["report"]},{"url":"https://bugzilla.suse.com/1180112","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0499","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210017-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-0499","tags":["report"]},{"url":"https://android.googlesource.com/platform/external/flac/+/029048f823ced50f63a92e25073427ec3a9bd909%5E%21/#F0","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5733-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-0499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-0561","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TWY2EXAD52MSG6ZRFPI2CF3APYF7OZ7F/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YI4EVQJJHK52U3OVX236TQ775IVEFDQS/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200944","tags":["report"]},{"url":"https://bugzilla.suse.com/1206142","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-0561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41325","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-0499","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","status":"published","published":"2020-12-15T15:58:18Z","modified":"2024-08-04T06:02:52.316Z","updated_at":"2026-11-02T14:35:59.763887Z"}],"euvd":[{"id":"EUVD-2020-1997","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","status":"published","published":"2020-12-15T15:58:18Z","modified":"2024-08-04T06:02:52Z","updated_at":"2026-11-03T03:08:19.671968Z"}],"ghsa":[{"id":"GHSA-qp4c-cv95-gwhh","title":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read...","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","status":"published","published":"2022-05-24T17:36:27Z","modified":"2023-01-29T05:05:04Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:45:42.123832Z"}],"nvd":[{"id":"CVE-2020-0499","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","status":"published","published":"2020-12-15T16:15:14.65Z","modified":"2026-06-17T02:45:56.2Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:27.73474Z"}],"osv":[{"id":"ALPINE-CVE-2020-0499","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","status":"published","published":"2020-12-15T16:15:14.65Z","modified":"2026-10-26T11:17:55.094989394Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-0499","title":"CVE-2020-0499 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:22.334074Z","modified":"2026-01-26T09:47:22.776721Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-0499","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","status":"published","published":"2020-12-15T16:15:14.65Z","modified":"2026-04-16T04:34:10.058028804Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-0499","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","status":"published","published":"2020-12-15T16:15:14.65Z","modified":"2026-10-26T12:01:11.255292014Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"OESA-2022-1697","title":"flac security update","description":"FLAC stands for Free Lossless Audio Codec, an audio format similar to MP3, but lossless, meaning that audio is compressed in FLAC without any loss in quality.\r\n\r\nSecurity Fix(es):\r\n\r\nIn FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070(CVE-2020-0499)","status":"published","published":"2022-06-02T11:04:58Z","modified":"2026-08-18T01:16:43.78066033Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2020-0499","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070","status":"published","published":"2020-12-15T16:15:00Z","modified":"2026-04-22T12:26:02.772944Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-2514-1","title":"flac - security update","status":"published","published":"2021-01-04T00:00:00Z","modified":"2026-03-09T01:22:39.31522Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2020-0480","title":"Updated flac packages fix security vulnerability","description":"In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible\nout of bounds read due to a heap buffer overflow. This could lead to remote\ninformation disclosure with no additional execution privileges needed. User\ninteraction is needed for exploitation (CVE-2020-0499).\n","status":"published","published":"2020-12-29T11:57:17Z","modified":"2026-04-16T04:42:09.9371089Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:2348-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2020-0487: Fixed a memory leak (bsc#1180112).\n- CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-12-27T17:22:17Z","modified":"2026-02-04T02:27:48.309196Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2020:2350-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2020-0487: Fixed a memory leak (bsc#1180112).\n- CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-12-28T05:22:03Z","modified":"2026-02-04T03:16:33.208742Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2022:10252-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\n- Update to version 3.0.18 (CVE-2022-41325, boo#1206142):\n  + macOS: Fix audio device listing with non-latin names.\n  + Misc: Fix rendering and performance issue with older GPUs.\n  + Updated translations.\n- Changes from version 3.0.18-rc2:\n  + Codec/Demux:\n    - Add support for Y16 chroma.\n    - Fix build of gme plugin.\n  + Lua:\n    - Fix script for vocaroo.\n    - Fix script for youtube to allow throttled playback.\n  + Service Discovery: Fix UPnP regression on Windows.\n  + Video Output: Fix video placement with caopengllayer.\n  + Misc: Fix password search in kwallet module.\n- Changes from version 3.0.18-rc:\n  + Demux:\n    - Major adaptive streaming update, notably for multiple\n      timelies and webvtt.\n    - Fix seeking with some fragmented MP4 files.\n    - Add support for DVBSub inside MKV.\n    - Fix some Flac files that could not be played.\n    - Improve seeking in Ogg files.\n  + Decoders:\n    - Fix DxVA/D3D11 crashes on HEVC files with bogus references.\n    - Fix libass storage size and crash.\n    - Fix decoding errors on macOS hw decoding on some HEVC files.\n  + Video Output:\n    - Fix color regression with VAAPI/iOS and OpenGL output.\n    - Fix some resizing issues with OpenGL on GLX/EGL/X11/XV.\n    - Fix Direct3d9 texture stretching.\n    - Fix 10-bit accelerated video filters on macOS.\n  + Playlist: Avoid playlist liveloop on failed/tiny items\n    (temporize EOS bursts).\n  + Misc:\n    - Misc fixes for the extension UI on macOS.\n    - Improve SMBv1 and SMBv2 behaviours.\n    - Improve FTP compatibility.\n    - Support RISC-V.\n    - Fix AVI muxing for Windows Media Player compatibility.\n    - Fix seeking speed on macOS.\n","status":"published","published":"2022-12-27T09:00:21Z","modified":"2026-02-04T04:04:33.417416Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11885-1","title":"flac-1.3.4-1.1 on GA media","description":"These are all security issues fixed in the flac-1.3.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:41:47.153419Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:11951-1","title":"libvlc5-3.0.17-1.1 on GA media","description":"These are all security issues fixed in the libvlc5-3.0.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:51:23.454466Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2020:3933-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2020-0487: Fixed a memory leak (bsc#1180112).\n- CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).\n","status":"published","published":"2020-12-24T11:36:42Z","modified":"2026-02-04T02:53:47.908951Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0017-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2020-0499: Fixed an out-of-bounds access (bsc#1180099).\n","status":"published","published":"2021-01-04T13:47:24Z","modified":"2026-02-04T02:43:50.879714Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-5733-1","title":"flac vulnerabilities","description":"It was discovered that FLAC was not properly performing memory management\noperations, which could result in a memory leak. An attacker could possibly\nuse this issue to cause FLAC to consume resources, leading to a denial of\nservice. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and\nUbuntu 18.04 LTS. (CVE-2017-6888)\n\nIt was discovered that FLAC was not properly performing bounds checking\noperations when decoding data. If a user or automated system were tricked\ninto processing a specially crafted file, an attacker could possibly use\nthis issue to expose sensitive information or to cause FLAC to crash,\nleading to a denial of service. This issue only affected Ubuntu 14.04 ESM,\nUbuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-0499)\n\nIt was discovered that FLAC was not properly performing bounds checking\noperations when encoding data. If a user or automated system were tricked\ninto processing a specially crafted file, an attacker could possibly use\nthis issue to expose sensitive information or to cause FLAC to crash,\nleading to a denial of service. (CVE-2021-0561)\n","status":"published","published":"2022-11-21T13:32:08Z","modified":"2026-06-29T13:50:42.75230737Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}