Cloud Foundry Logo
blog single gear
Security Advisory

USN-5733-1: FLAC vulnerabilities




Canonical Ubuntu

Versions Affected

  • Canonical Ubuntu 16.04
  • Canonical Ubuntu 18.04


It was discovered that FLAC was not properly performing memory management operations, which could result in a memory leak. An attacker could possibly use this issue to cause FLAC to consume resources, leading to a denial of service. (CVE-2017-6888) It was discovered that FLAC was not properly performing bounds checking operations when encoding or decoding data. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to expose sensitive information or to cause FLAC to crash, leading to a denial of service. (CVE-2020-0499, CVE-2021-0561) Update Instructions: Run `sudo pro fix USN-5733-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libflac-doc – 1.3.1-4ubuntu0.1~esm1 libflac-dev – 1.3.1-4ubuntu0.1~esm1 libflac++-dev – 1.3.1-4ubuntu0.1~esm1 flac – 1.3.1-4ubuntu0.1~esm1 libflac++6v5 – 1.3.1-4ubuntu0.1~esm1 libflac8 – 1.3.1-4ubuntu0.1~esm1 Available with Ubuntu Pro (Infra-only):

CVEs contained in this USN include: CVE-2017-6888, CVE-2020-0499, CVE-2021-0561.

Affected Cloud Foundry Products and Versions

Severity is low unless otherwise noted.

  • cflinuxfs3
    • All versions prior to 0.337.0
  • CF Deployment
    • All versions prior to 23.3.0


Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

  • cflinuxfs3
    • Upgrade all versions to 0.337.0 or greater
  • CF Deployment
    • Upgrade all versions to 23.3.0 or greater


2022-12-07: Initial vulnerability report published.

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR