CVE-2007-6279

Description

Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via malformed (1) Seektable values or (2) Seektable Data Offsets in a .FLAC file.

How to fix CVE-2007-6279

To remediate CVE-2007-6279, upgrade the affected package to a fixed version below.

• Debian/flac—upgrade to 1.2.1-1 or later

Is CVE-2007-6279 being exploited?

Low — EPSS is 2.8%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.2.1-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2007-6279