Debian Security Advisory DSA 3082-1 (flac - Security Update) Network Vulnerability

Summary

Michele Spagnuolo, of Google Security Team, and Miroslav Lichvar, of Red Hat, discovered two issues in flac, a library handling Free Lossless Audio Codec media: by providing a specially crafted FLAC file, an attacker could execute arbitrary code.

Solution

For the stable distribution (wheezy), these problems have been fixed in version 1.2.1-6+deb7u1. For the testing distribution (jessie) and unstable distribution (sid), these problems have been fixed in version 1.3.0-3. We recommend that you upgrade your flac packages.

Insight

FLAC stands for Free Lossless Audio Codec. Grossly oversimplified, FLAC is similar to MP3, but lossless. The FLAC project consists of:

Affected

flac on Debian Linux

Detection

This check tests the installed software version using the apt package manager.

References