Synopsis

Important: flac security update

Type/Severity

Security Advisory: Important

Topic

An updated flac package to correct a security issue is now available for
Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

FLAC is a Free Lossless Audio Codec. The flac package consists of a FLAC
encoder and decoder in library form, a program to encode and decode FLAC
files, a metadata editor for FLAC files and input plugins for various music
players.

A security flaw was found in the way flac processed audio data. An
attacker could create a carefully crafted FLAC audio file in such a way that
it could cause an application linked with flac libraries to crash or execute
arbitrary code when it was opened. (CVE-2007-4619)

Users of flac are advised to upgrade to this updated package, which
contains a backported patch that resolves this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 331991 - CVE-2007-4619 FLAC Integer overflows

CVEs

• CVE-2007-4619
• CVE-2007-6277

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
flac-1.1.0-7.el4_5.2.ppc.rpm	SHA-256: 5c867a0c5700916a6d47d36951abed9d37d0cbc733c3e65965d11c860d01c422
flac-1.1.0-7.el4_5.2.ppc64.rpm	SHA-256: bf4a477197a7df5650783ebbb90ee8dcee7de070a7581a5496d1f4b9e81fc0e5
flac-devel-1.1.0-7.el4_5.2.ppc.rpm	SHA-256: 5fddb2f5f003b568abb0504f9efb3f888dd604a95beeaa1568f5d9959871e8e4
xmms-flac-1.1.0-7.el4_5.2.ppc.rpm	SHA-256: 59fd6f20f2c6fbf6b6adbf6566d51ead9539ac450000041a7a90fd85d648f01a

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5

SRPM
ppc
flac-1.1.0-7.el4_5.2.ppc.rpm	SHA-256: 5c867a0c5700916a6d47d36951abed9d37d0cbc733c3e65965d11c860d01c422
flac-1.1.0-7.el4_5.2.ppc64.rpm	SHA-256: bf4a477197a7df5650783ebbb90ee8dcee7de070a7581a5496d1f4b9e81fc0e5
flac-devel-1.1.0-7.el4_5.2.ppc.rpm	SHA-256: 5fddb2f5f003b568abb0504f9efb3f888dd604a95beeaa1568f5d9959871e8e4
xmms-flac-1.1.0-7.el4_5.2.ppc.rpm	SHA-256: 59fd6f20f2c6fbf6b6adbf6566d51ead9539ac450000041a7a90fd85d648f01a