CVE Feed

    Dashboard / CVE / CVE-2007-4619

    CVE-2007-4619

    Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow.

    Published:Oct 11, 2007
    Last Modified:Apr 23, 2026
    EPS:Oct 12, 2007
    EPSS Score:0.07855
    CVSS Score:9.3

    Affected Products

    Vendor
    Flac
    Product
    Libflac
    Vendor
    Nullsoft
    Product
    Winamp
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-190 Integer Overflow or Wraparound

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    References

    http://bugzilla.redhat.com/show_bug.cgi?id=331991
    http://flac.sourceforge.net/changelog.html#flac_1_2_1
    http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608
    http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html
    http://secunia.com/advisories/27210
    http://secunia.com/advisories/27223
    http://secunia.com/advisories/27355
    http://secunia.com/advisories/27399
    http://secunia.com/advisories/27507
    http://secunia.com/advisories/27601
    http://secunia.com/advisories/27625
    http://secunia.com/advisories/27628
    http://secunia.com/advisories/27780
    http://secunia.com/advisories/27878
    http://secunia.com/advisories/28548
    http://security.gentoo.org/glsa/glsa-200711-15.xml
    http://securitytracker.com/id?1018815
    http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243
    http://www.debian.org/security/2008/dsa-1469
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:214
    http://www.redhat.com/support/errata/RHSA-2007-0975.html
    http://www.securityfocus.com/bid/26042
    http://www.ubuntu.com/usn/usn-540-1
    http://www.vupen.com/english/advisories/2007/3483
    http://www.vupen.com/english/advisories/2007/3484
    http://www.vupen.com/english/advisories/2007/4061
    https://bugzilla.redhat.com/show_bug.cgi?id=332571
    https://exchange.xforce.ibmcloud.com/vulnerabilities/37187
    https://issues.rpath.com/browse/RPL-1873
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10571
    https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html
    http://bugzilla.redhat.com/show_bug.cgi?id=331991
    http://flac.sourceforge.net/changelog.html#flac_1_2_1
    http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608
    http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html
    http://secunia.com/advisories/27210
    http://secunia.com/advisories/27223
    http://secunia.com/advisories/27355
    http://secunia.com/advisories/27399
    http://secunia.com/advisories/27507
    http://secunia.com/advisories/27601
    http://secunia.com/advisories/27625
    http://secunia.com/advisories/27628
    http://secunia.com/advisories/27780
    http://secunia.com/advisories/27878
    http://secunia.com/advisories/28548
    http://security.gentoo.org/glsa/glsa-200711-15.xml
    http://securitytracker.com/id?1018815
    http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243
    http://www.debian.org/security/2008/dsa-1469
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:214
    http://www.redhat.com/support/errata/RHSA-2007-0975.html
    http://www.securityfocus.com/bid/26042
    http://www.ubuntu.com/usn/usn-540-1
    http://www.vupen.com/english/advisories/2007/3483
    http://www.vupen.com/english/advisories/2007/3484
    http://www.vupen.com/english/advisories/2007/4061
    https://bugzilla.redhat.com/show_bug.cgi?id=332571
    https://exchange.xforce.ibmcloud.com/vulnerabilities/37187
    https://issues.rpath.com/browse/RPL-1873
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10571
    https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High