992 matches found
CLEANSTART-2026-GT68103 GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability
Security vulnerability affects the gst-plugins-good package. GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability...
Rocky Linux 8.6 [CIQ] Security Update: flac / flac-libs Multiple Vulnerabilities (ciqsa-2026_1598)
The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261598 advisory. This advisory aggregates security fixes for the flac SRPM in CIQ LTS 8.6. It addresses 3 CVEs: CVE-2014-8962, CVE-2014-9028, CVE-2017-6888. Tenable has...
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...
GHSA-JJPR-9CVF-CQ55 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...
Astra Linux – Vulnerability in gst-plugins-good1.0
GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may vary...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Good Plugins vulnerabilities (USN-8863-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8863-1 advisory. Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio...
USN-8863-1 gst-plugins-good1.0 vulnerabilities
Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio streams. An attacker could possibly use this issue to obtain sensitive information. CVE-2026-17072 Seonwook Kim discovered that GStreamer Good Plugins incorrectly parsed certain AVI files. An attacker cou...
USN-8863-1: GStreamer Good Plugins vulnerabilities
Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio streams. An attacker could possibly use this issue to obtain sensitive information. CVE-2026-17072 Seonwook Kim discovered that GStreamer Good Plugins incorrectly parsed certain AVI files. An attacker cou...
Rocky Linux 9 [CIQ] Security Update: flac / flac-debuginfo / flac-debugsource / flac-devel / flac-libs / etc (crlsa-2022_8078)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20228078 advisory. flac: out of bound write in appendtoverifyfifointerleaved of streamencoder.c CVE-2021-0561 Tenable has extracted the preceding description block directly from the C...
Rocky Linux 8 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc (crlsa-2024_3089)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243089 advisory. gstreamer-plugins-good: integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the preceding description block...
Rocky Linux 9 [CIQ] Security Update: flac / flac-debuginfo / flac-debugsource / flac-devel / flac-libs / etc (crlsa-2023_5048)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235048 advisory. flac: Remote Code Execution RCE via the bitwritergrow function, by supplying crafted input to the encoder CVE-2020-22219 Tenable has extracted the preceding...
Rocky Linux 8.6 [CIQ] Security Update: flac / flac-debuginfo / flac-debugsource / flac-libs / etc (ciqsa-2026_0807)
The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260807 advisory. This advisory aggregates security fixes for the flac SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2020-22219. Tenable has extracted the preceding description bloc...
AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc (ALMALINUX9.2:CLSA-2025:1751141320)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751141320 advisory. - GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...
Astra Linux – Vulnerability in FLAC
A buffer overflow vulnerability exists in the function bitwritergrow in FLAC before version 1.4.0, allowing remote attackers to execute arbitrary code through crafted inputs to the encoder...
Astra Linux – Vulnerability in FLAC
In streamencoder.c, there is a potential out-of-bounds write due to a missing bounds check. This could lead to exposure of local information without requiring additional execution privileges. User interaction is not required for exploitation. Product: Android Versions: Android-11 Android ID:...
Astra Linux – Vulnerability in libsndfile
A out-of-bounds read flaw was discovered in the FLAC codec functionality of libsndfile. An attacker who can submit a specially crafted file by tricking a user into opening it or otherwise to an application that uses libsndfile and the FLAC codec, could trigger an out-of-bounds read. This would mo...
Astra Linux – Vulnerability in FLAC
In FLACbitreaderreadricesignedblock of bitreader.c, there is a potential out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure without requiring additional execution privileges. User interaction is required for exploitation. Product: Android. Versions:...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the transcription due to improper validation of audio sample rate headers. An...
CVE-2026-90555
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...
CVE-2026-90555
A flaw was found in vLLM. An authenticated client can exploit this vulnerability by submitting forged FLAC Free Lossless Audio Codec headers with an inflated sample rate to the transcription endpoint. This bypasses duration checks, leading to excessive memory allocation within the API server...