CVE-2014-9028

Publication date 26 November 2014

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Description

Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.

Read the notes from the security team

Status

Package Ubuntu Release Status
android 15.10 wily Ignored
15.04 vivid Ignored
14.04 LTS trusty Not in release
12.04 LTS precise Not in release
flac 15.10 wily
Not affected
15.04 vivid
Fixed 1.3.0-2ubuntu1
14.10 utopic
Fixed 1.3.0-2ubuntu0.14.10.1
14.04 LTS trusty
Fixed 1.3.0-2ubuntu0.14.04.1
12.04 LTS precise
Fixed 1.2.1-6ubuntu0.1
10.04 LTS lucid
Fixed 1.2.1-2ubuntu0.1

Notes

sbeattie

android moved from libflac 1.2.1 to 1.3.1, plus extra fix listed below

jdstrand

as with previous stagefright issues, this issue affects Ubuntu's android packages, but not in a way that is exposed to apps. See CVE-2015-1538 for details

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
android
flac

References

Related Ubuntu Security Notices (USN)

    • USN-2426-1
    • FLAC vulnerabilities
    • 27 November 2014

Other references

Access our resources on patching vulnerabilities