Debian alert DLA-3094-1 (flac)

From:
             
 
Utkarsh Gupta <guptautkarsh2102@gmail.com>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3094-1] flac security update
Date:
             
 
Sun, 04 Sep 2022 02:15:09 +0530
Message-ID:
             
 
 <CAPP0f97Bv=8bVCdxW5-domqMHZFJpk2MfW67f6q4vxvfJGce0Q@mail.gmail.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -----------------------------------------------------------------------
Debian LTS Advisory DLA-3094-1              debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Utkarsh Gupta
September 04, 2022                          https://wiki.debian.org/LTS
- -----------------------------------------------------------------------

Package        : flac
Version        : 1.3.2-3+deb10u2
CVE ID         : CVE-2021-0561
Debian Bug     : 1006339

In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is
a possible out of bounds write due to a missing bounds check. This
could lead to local information disclosure with no additional
execution privileges needed.

For Debian 10 buster, this problem has been fixed in version
1.3.2-3+deb10u2.

We recommend that you upgrade your flac packages.

For the detailed security status of flac please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/flac

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmMTvI0ACgkQgj6WdgbD
S5ajig/+ME3ylsFbR21JavmLY/XEPOY9IeLTvqIUuFpjuIC4HAl3tTr/4nSt08tD
1BWRdLL1Zlm3P6B0oLNMOdc1ILI4cc4e+G1mQpnK6a3OYavEF/vHwvuXAWC9G+7Q
wHuiuLkM0WDmSzggZgb8oSgM7G8RRkiYUuYiHVXnOx4ZAgwkG9Bp9zQn+xiaEBlh
aWAimKMYVbocbJMZuPkZsq8wySe/gW7lH3ORr27OmxV0Zyj/EY5hEN6/Zuk+seSO
UM+qVjcaaVmfDQwvIQ070mrlv8LVPjY5l9cFDb4GO1MyjV+5sHd07IGXFI+Fn/AX
REvqiw4IQ1NlctFoYM6O6aAFFPDHDOBLtoEYHRUNBBge+6NQCttLT6XzuWvTTOeT
oPD1Vd8mnx8eICedZu3K4nuvpnoEyaUtJPpRScabUQOn3M2ECr7aHhe678W3OFCA
8ArMAu8fTCrxfbBLC+30yBs1G7FJ0JOJoWY/NX7BsY0jui5NbWkdVhJWYYmxKDYR
xpE1UDQ+m7TgWcuhFuJIJd5Q7gBrwlTz9uNNFyow3ptlE/4g3dROWcwzonrtzU90
MZycsCy4XQbGxva2YUt31XcchH8B9YwMp2tv3xkua/Zq06z5v23JtlpuTiluXYG5
pFLgw8X6pX27fC6/D70ymzfAqLGU/E358vdOylCB40L1nkaZ4dc=
=LvUL
-----END PGP SIGNATURE-----