CVE编号
CVE-2007-4619利用情况
暂无补丁情况
官方补丁披露时间
2007-10-13漏洞描述
1.2.1之前的 Free Lossless Audio Codec (FLAC) libFLAC 中的多个整数溢出(如5.5之前的Winamp和其他产品中所使用的)允许用户辅助的远程攻击者通过错误的FLAC文件触发不正确的内存分配，从而导致基于堆的缓冲区溢出，执行任意代码。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| http://bugzilla.redhat.com/show_bug.cgi?id=331991 | |
| http://flac.sourceforge.net/changelog.html#flac_1_2_1 | |
| http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608 | |
| http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html | |
| http://secunia.com/advisories/27210 | |
| http://secunia.com/advisories/27223 | |
| http://secunia.com/advisories/27355 | |
| http://secunia.com/advisories/27399 | |
| http://secunia.com/advisories/27507 | |
| http://secunia.com/advisories/27601 | |
| http://secunia.com/advisories/27625 | |
| http://secunia.com/advisories/27628 | |
| http://secunia.com/advisories/27780 | |
| http://secunia.com/advisories/27878 | |
| http://secunia.com/advisories/28548 | |
| http://security.gentoo.org/glsa/glsa-200711-15.xml | |
| http://securitytracker.com/id?1018815 | |
| http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243 | |
| http://www.debian.org/security/2008/dsa-1469 | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:214 | |
| http://www.redhat.com/support/errata/RHSA-2007-0975.html | |
| http://www.securityfocus.com/bid/26042 | |
| http://www.ubuntu.com/usn/usn-540-1 | |
| http://www.vupen.com/english/advisories/2007/3483 | |
| http://www.vupen.com/english/advisories/2007/3484 | |
| http://www.vupen.com/english/advisories/2007/4061 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=332571 | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/37187 | |
| https://issues.rpath.com/browse/RPL-1873 | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... | |
| https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | flac | libflac | * |
Up to (including) 1.2 |
|||||
| 运行在以下环境 | |||||||||
| 应用 | nullsoft | winamp | * |
Up to (including) 5.35 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_5 | flac | * |
Up to (excluding) 1.1.2-28.el5_0.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_3.1 | flac | * |
Up to (excluding) 1.1.1-5sarge1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_4.0 | flac | * |
Up to (excluding) 1.1.2-8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | flac | * |
Up to (excluding) 1.1.2-28.el5_0.1 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 全局影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 数据泄露
- 数据完整性 传输被破坏
- 服务器危害 服务器失陷
- 全网数量 N/A
还没有评论，来说两句吧...