- Canonical Ubuntu 16.04
- Canonical Ubuntu 18.04
It was discovered that FLAC was not properly performing memory management operations, which could result in a memory leak. An attacker could possibly use this issue to cause FLAC to consume resources, leading to a denial of service. (CVE-2017-6888) It was discovered that FLAC was not properly performing bounds checking operations when encoding or decoding data. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to expose sensitive information or to cause FLAC to crash, leading to a denial of service. (CVE-2020-0499, CVE-2021-0561) Update Instructions: Run `sudo pro fix USN-5733-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libflac-doc – 1.3.1-4ubuntu0.1~esm1 libflac-dev – 1.3.1-4ubuntu0.1~esm1 libflac++-dev – 1.3.1-4ubuntu0.1~esm1 flac – 1.3.1-4ubuntu0.1~esm1 libflac++6v5 – 1.3.1-4ubuntu0.1~esm1 libflac8 – 1.3.1-4ubuntu0.1~esm1 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
CVEs contained in this USN include: CVE-2017-6888, CVE-2020-0499, CVE-2021-0561.
Affected Cloud Foundry Products and Versions
Severity is low unless otherwise noted.
- All versions prior to 0.337.0
- CF Deployment
- All versions prior to 23.3.0
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- Upgrade all versions to 0.337.0 or greater
- CF Deployment
- Upgrade all versions to 23.3.0 or greater
2022-12-07: Initial vulnerability report published.