CVE catalog

CVE-2007-6277

flac: CVE-2007-6277

Severity: Medium
Published: Oct 22, 2007, 3:46:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 6.74% · Oct 22, 2026

Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large (1) Metadata Block Size, (2) VORBIS Comment String Size, (3) Picture Metadata MIME-TYPE Size, (4) Picture Description Size, (5) Picture Data Length, (6) Padding Length, and (7) PICTURE Metadata width and height values in a .FLAC file, which result in a heap-based overflow; and large (8) VORBIS Comment String Size Length, (9) Picture MIME-Type, (10) Picture MIME-Type URL, and (11) Picture Description Length values in a .FLAC file, which result in a stack-based overflow. NOTE: some of these issues may overlap CVE-2007-4619.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	flac	sid	`1.5.0+ds-5`	fixed
Debian	flac	forky	`1.5.0+ds-5`	fixed
Debian	flac	trixie	`1.5.0+ds-2`	fixed
Debian	flac	bookworm	`1.4.2+ds-2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	flac	source	sid	`1.2.1-1`	not yet assigned	Not reported	Not reported
Debian	flac	source	forky	`1.2.1-1`	not yet assigned	Not reported	Not reported
Debian	flac	source	trixie	`1.2.1-1`	not yet assigned	Not reported	Not reported
Debian	flac	source	bookworm	`1.2.1-1`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[flac]Fixed
Details (2)
- 1.4.2+ds-2 · amd64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
- 1.4.2+ds-2 · arm64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
[libflac++10]Fixed
Source package: [flac]
Details (2)
- 1.4.2+ds-2 · amd64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
- 1.4.2+ds-2 · arm64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
[libflac12]Fixed
Source package: [flac]
Details (2)
- 1.4.2+ds-2 · amd64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
- 1.4.2+ds-2 · arm64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
[libflac++-dev]Fixed
Source package: [flac]
Details (2)
- 1.4.2+ds-2 · amd64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
- 1.4.2+ds-2 · arm64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
[libflac-dev]Fixed
Source package: [flac]
Details (2)
- 1.4.2+ds-2 · amd64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
- 1.4.2+ds-2 · arm64 · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
[libflac-doc]Fixed
Source package: [flac]
Details (2)
- 1.4.2+ds-2 · all · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12
- 1.4.2+ds-2 · all · bookworm
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · bookworm; dsa · flac · debian · 12

[Debian 13 (Trixie)]

[flac]Fixed
Details (2)
- 1.5.0+ds-2 · amd64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
- 1.5.0+ds-2 · arm64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
[libflac++11]Fixed
Source package: [flac]
Details (2)
- 1.5.0+ds-2 · amd64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
- 1.5.0+ds-2 · arm64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
[libflac14]Fixed
Source package: [flac]
Details (2)
- 1.5.0+ds-2 · amd64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
- 1.5.0+ds-2 · arm64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
[libflac++-dev]Fixed
Source package: [flac]
Details (2)
- 1.5.0+ds-2 · amd64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
- 1.5.0+ds-2 · arm64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
[libflac-dev]Fixed
Source package: [flac]
Details (2)
- 1.5.0+ds-2 · amd64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
- 1.5.0+ds-2 · arm64 · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
[libflac-doc]Fixed
Source package: [flac]
Details (2)
- 1.5.0+ds-2 · all · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13
- 1.5.0+ds-2 · all · trixie
  Fixed · Fixed: 1.2.1-1
  dsa · flac · debian · 13

Observed: Oct 23, 2026, 5:03:58 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]