{"id":"CVE-2021-0561","aliases":["A-174302683","ALPINE-CVE-2021-0561","ALSA-2022:8078","BELL-CVE-2021-0561","DEBIAN-CVE-2021-0561","DLA-2951-1","DLA-3094-1","EUVD-2021-3180","GHSA-crfc-rr25-6wf2","MGASA-2022-0085","OESA-2022-1611","PUB-A-174302683","RHSA-2022:8078","RLSA-2022:8078","SUSE-SU-2022:0814-1","SUSE-SU-2022:0815-1","UBUNTU-CVE-2021-0561","USN-5733-1","openSUSE-SU-2022:0815-1","openSUSE-SU-2022:10252-1","openSUSE-SU-2024:11885-1"],"status":"published","title":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds...","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00465,"percentile":0.40683,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-06-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"flac","fixed_in":["1.3.4-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flac","fixed_in":["1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flac-devel","fixed_in":["1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flac-libs","fixed_in":["1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"flac","fixed_in":["1.3.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flac","fixed_in":["1.3.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flac","fixed_in":["1.3.4-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"flac","fixed_in":["1.3.2-2+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"flac","fixed_in":["1.3.2-3+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"flac","fixed_in":["1.3.3-3.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"flac","fixed_in":["1.3.3-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"flac","fixed_in":["1.3.3-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"flac","fixed_in":["1.3.3-5.oe1"],"sources":["osv"]},{"ecosystem":"Android","package":"platform/external/flac","fixed_in":["11:2021-06-01"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac-debuginfo","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac-debugsource","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac-libs","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac-libs-debuginfo","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac-debuginfo","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac-debugsource","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac-devel","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac-libs-debuginfo","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"flac","fixed_in":["0:1.3.3-10.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"flac","fixed_in":["1.3.0-18.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"flac","fixed_in":["1.3.0-18.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"flac","fixed_in":["1.3.0-18.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"flac","fixed_in":["1.3.0-18.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"flac","fixed_in":["1.3.2-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"flac","fixed_in":["1.3.2-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"flac","fixed_in":["1.3.2-3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","fixed_in":["1.3.0-2ubuntu0.14.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","fixed_in":["1.3.1-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"flac","fixed_in":["1.3.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"flac","fixed_in":["1.3.3-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"flac","fixed_in":["1.3.3-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"flac","fixed_in":["1.3.2-3.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flac-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flac-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2+deb9u2"}]}],"versions":["1.3.2-1","1.3.2-2","1.3.2-2+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3+deb10u2"}]}],"versions":["1.3.2-3","1.3.2-3+deb10u1"]},{"source":"osv","ecosystem":"Mageia:8","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-3.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-5.oe1"}]}]},{"source":"osv","ecosystem":"Android","package":"platform/external/flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-06-01"}]}],"versions":["11"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flac-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flac-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-10.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-18.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-18.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-18.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-18.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.14.04.1+esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.3.0-2ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-4ubuntu0.1~esm1"}]}],"versions":["1.3.1-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1ubuntu0.1"}]}],"versions":["1.3.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.3-1","1.3.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-2ubuntu0.1"}]}],"versions":["1.3.3-2","1.3.3-2build1","1.3.3-2build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.14.04.1+esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.3.0-2ubuntu0.14.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-4ubuntu0.1~esm1"}]}],"versions":["1.3.1-4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1ubuntu0.1"}]}],"versions":["1.3.2-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.3-1","1.3.3-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-2ubuntu0.1"}]}],"versions":["1.3.3-2","1.3.3-2build1","1.3.3-2build2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-bp153.2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-bp153.2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/security/bulletin/pixel/2021-06-01","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWXBVMPPSL377I7YM55ZYXVKVMYOKES2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4Y7BW35TGNFYBYBSBDSGLUJHHTYEUSG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-0561","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWXBVMPPSL377I7YM55ZYXVKVMYOKES2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4Y7BW35TGNFYBYBSBDSGLUJHHTYEUSG/"},{"url":"https://github.com/advisories/GHSA-crfc-rr25-6wf2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-0561","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8078","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-0561","tags":["report"]},{"url":"https://bugzilla.redhat.com/2057776","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8078.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-0561","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-0561","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0085.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30098","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EWXBVMPPSL377I7YM55ZYXVKVMYOKES2/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1611","tags":["advisory"]},{"url":"https://source.android.com/security/bulletin/2021-06-01","tags":["advisory"]},{"url":"https://android.googlesource.com/platform/external/flac/+/368eb3f5bec249a197c95a95583ff8153aa6a87f","tags":["fix","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057776","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8078.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-0561","tags":["advisory","report"]},{"url":"https://github.com/xiph/flac/issues/243","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8078","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220814-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196660","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-0561","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220815-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-0561","tags":["report"]},{"url":"https://github.com/xiph/flac/commit/e1575e4a7c5157cbf4e4a16dbd39b74f7174c7be","tags":["report"]},{"url":"https://xiph.org/flac/changelog.html#flac_1.3.4","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5733-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-6888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-0499","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XL4H6UZUJ7J37CDBIJWGDOHX5XDWRWL6/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YI4EVQJJHK52U3OVX236TQ775IVEFDQS/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200944","tags":["report"]},{"url":"https://bugzilla.suse.com/1206142","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41325","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-0561","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","status":"published","published":"2021-06-22T11:00:12Z","modified":"2024-08-03T15:47:27.927Z","updated_at":"2026-11-02T14:33:10.555814Z"}],"euvd":[{"id":"EUVD-2021-3180","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","status":"published","published":"2021-06-22T11:00:12Z","modified":"2024-08-03T15:47:27Z","updated_at":"2026-11-03T03:25:16.987587Z"}],"ghsa":[{"id":"GHSA-crfc-rr25-6wf2","title":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds...","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","status":"published","published":"2022-05-24T19:05:56Z","modified":"2023-02-01T05:03:15Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:02.739665Z"}],"nvd":[{"id":"CVE-2021-0561","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","status":"published","published":"2021-06-22T11:15:08.387Z","modified":"2026-06-17T03:30:19.693Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:54.892562Z"}],"osv":[{"id":"ALPINE-CVE-2021-0561","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","status":"published","published":"2021-06-22T11:15:08.387Z","modified":"2026-10-23T17:17:56.134605492Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-0561","title":"CVE-2021-0561 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:32.918717Z","modified":"2026-01-26T09:48:32.113174Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-0561","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","status":"published","published":"2021-06-22T11:15:08.387Z","modified":"2026-04-16T04:38:21.431808802Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2021-0561","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","status":"published","published":"2021-06-22T11:15:08.387Z","modified":"2026-10-23T18:04:48.842682487Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"OESA-2022-1611","title":"flac security update","description":"FLAC stands for Free Lossless Audio Codec, an audio format similar to MP3, but lossless, meaning that audio is compressed in FLAC without any loss in quality.\r\n\r\nSecurity Fix(es):\r\n\r\nIn append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683(CVE-2021-0561)","status":"published","published":"2022-04-12T11:04:53Z","modified":"2026-08-18T01:16:27.731121062Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:8078","title":"Red Hat Security Advisory: flac security update","status":"published","published":"2024-09-16T08:06:14Z","modified":"2026-06-26T12:22:29.708852507Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:8078","title":"Moderate: flac security update","description":"FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files.\n\nSecurity Fix(es):\n\n* flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c (CVE-2021-0561)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.","status":"published","published":"2022-11-15T06:15:08Z","modified":"2026-02-05T10:45:10.091229Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-0561","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174302683","status":"published","published":"2021-06-22T11:15:00Z","modified":"2026-04-22T12:44:26.443143Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2022:8078","title":"Moderate: flac security update","description":"FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files.\n\nSecurity Fix(es):\n\n* flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c (CVE-2021-0561)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:31:19.617379037Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"DLA-2951-1","title":"flac - security update","status":"published","published":"2022-03-17T00:00:00Z","modified":"2026-03-09T01:18:48.420083Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3094-1","title":"flac - security update","status":"published","published":"2022-09-04T00:00:00Z","modified":"2026-03-09T01:19:00.123703Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0085","title":"Updated flac packages fix security vulnerability","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a\npossible out of bounds write due to a missing bounds check. This could\nlead to local information disclosure with no additional execution\nprivileges needed. User interaction is not needed for exploitation.\n(CVE-2021-0561)\n","status":"published","published":"2022-03-06T10:40:17Z","modified":"2026-04-16T04:42:49.296269785Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0815-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660).\n","status":"published","published":"2022-03-14T09:22:01Z","modified":"2025-05-07T18:12:20.190834Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10252-1","title":"Security update for vlc","description":"This update for vlc fixes the following issues:\n\n- Update to version 3.0.18 (CVE-2022-41325, boo#1206142):\n  + macOS: Fix audio device listing with non-latin names.\n  + Misc: Fix rendering and performance issue with older GPUs.\n  + Updated translations.\n- Changes from version 3.0.18-rc2:\n  + Codec/Demux:\n    - Add support for Y16 chroma.\n    - Fix build of gme plugin.\n  + Lua:\n    - Fix script for vocaroo.\n    - Fix script for youtube to allow throttled playback.\n  + Service Discovery: Fix UPnP regression on Windows.\n  + Video Output: Fix video placement with caopengllayer.\n  + Misc: Fix password search in kwallet module.\n- Changes from version 3.0.18-rc:\n  + Demux:\n    - Major adaptive streaming update, notably for multiple\n      timelies and webvtt.\n    - Fix seeking with some fragmented MP4 files.\n    - Add support for DVBSub inside MKV.\n    - Fix some Flac files that could not be played.\n    - Improve seeking in Ogg files.\n  + Decoders:\n    - Fix DxVA/D3D11 crashes on HEVC files with bogus references.\n    - Fix libass storage size and crash.\n    - Fix decoding errors on macOS hw decoding on some HEVC files.\n  + Video Output:\n    - Fix color regression with VAAPI/iOS and OpenGL output.\n    - Fix some resizing issues with OpenGL on GLX/EGL/X11/XV.\n    - Fix Direct3d9 texture stretching.\n    - Fix 10-bit accelerated video filters on macOS.\n  + Playlist: Avoid playlist liveloop on failed/tiny items\n    (temporize EOS bursts).\n  + Misc:\n    - Misc fixes for the extension UI on macOS.\n    - Improve SMBv1 and SMBv2 behaviours.\n    - Improve FTP compatibility.\n    - Support RISC-V.\n    - Fix AVI muxing for Windows Media Player compatibility.\n    - Fix seeking speed on macOS.\n","status":"published","published":"2022-12-27T09:00:21Z","modified":"2026-02-04T04:04:33.417416Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11885-1","title":"flac-1.3.4-1.1 on GA media","description":"These are all security issues fixed in the flac-1.3.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:41:47.153419Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PUB-A-174302683","description":"In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2021-06-01T00:00:00Z","modified":"2026-11-11T16:12:36.322289056Z","updated_at":"2026-11-10T17:35:07.907985Z"},{"id":"SUSE-SU-2022:0814-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660).\n","status":"published","published":"2022-03-14T09:21:35Z","modified":"2026-02-04T04:20:58.807081Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0815-1","title":"Security update for flac","description":"This update for flac fixes the following issues:\n\n- CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660).\n","status":"published","published":"2022-03-14T09:21:38Z","modified":"2026-02-04T03:14:43.136488Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-5733-1","title":"flac vulnerabilities","description":"It was discovered that FLAC was not properly performing memory management\noperations, which could result in a memory leak. An attacker could possibly\nuse this issue to cause FLAC to consume resources, leading to a denial of\nservice. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and\nUbuntu 18.04 LTS. (CVE-2017-6888)\n\nIt was discovered that FLAC was not properly performing bounds checking\noperations when decoding data. If a user or automated system were tricked\ninto processing a specially crafted file, an attacker could possibly use\nthis issue to expose sensitive information or to cause FLAC to crash,\nleading to a denial of service. This issue only affected Ubuntu 14.04 ESM,\nUbuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-0499)\n\nIt was discovered that FLAC was not properly performing bounds checking\noperations when encoding data. If a user or automated system were tricked\ninto processing a specially crafted file, an attacker could possibly use\nthis issue to expose sensitive information or to cause FLAC to crash,\nleading to a denial of service. (CVE-2021-0561)\n","status":"published","published":"2022-11-21T13:32:08Z","modified":"2026-06-29T13:50:42.75230737Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}