CVE catalog

CVE-2020-0499

flac: CVE-2020-0499

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
4.14% · Oct 22, 2026

In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianflacsid1.5.0+ds-5fixed
Debianflacforky1.5.0+ds-5fixed
Debianflactrixie1.5.0+ds-2fixed
Debianflacbookworm1.4.2+ds-2fixed
Alpineflac3.121.3.4-r0fixed
Alpineflac3.131.3.4-r0fixed
Alpineflac3.141.3.4-r0fixed
Alpineflac3.151.3.4-r0fixed
Alpineflac3.161.3.4-r0fixed
Alpineflac3.171.3.4-r0fixed
Alpineflac3.181.3.4-r0fixed
Alpineflac3.191.3.4-r0fixed
Alpineflac3.201.3.4-r0fixed
Alpineflac3.211.3.4-r0fixed
Alpineflac3.221.3.4-r0fixed
Alpineflac3.231.3.4-r0fixed
Alpineflac3.241.3.4-r0fixed
Ubuntuflacpro1.3.1-4vulnerable
Ubuntuflacpro1.3.1-4ubuntu0.1~esm1fixed
Ubuntuflac18.041.3.2-1vulnerable
Ubuntuflac18.041.3.2-1ubuntu0.1fixed
Ubuntuflac20.041.3.3-1vulnerable
Ubuntuflac20.041.3.3-1build1vulnerable
Ubuntuflac20.041.3.3-1ubuntu0.1fixed
Susevlcpackage hub 15 sp33.0.18-bp153.2.6.1fixed
Opensusevlcleap 15.33.0.18-bp153.2.6.1fixed
Opensuseflacleap 15.21.3.2-lp152.5.3.1fixed
Suseflaclinux enterprise module for basesystem 15 sp11.3.2-3.6.1fixed
Suseflaclinux enterprise module for basesystem 15 sp21.3.2-3.6.1fixed
Suseflaclinux enterprise module for package hub 15 sp11.3.2-3.6.1fixed
Suseflaclinux enterprise module for package hub 15 sp21.3.2-3.6.1fixed
Suseflaclinux enterprise high performance computing 15-espos1.3.2-3.6.1fixed
Suseflaclinux enterprise high performance computing 15-ltss1.3.2-3.6.1fixed
Suseflaclinux enterprise server 15-ltss1.3.2-3.6.1fixed
Suseflaclinux enterprise server for sap applications 151.3.2-3.6.1fixed
Opensusevlctumbleweed3.0.17-1.1fixed
Suseflachpe helion openstack 81.3.0-12.3.1fixed
Suseflacopenstack cloud 71.3.0-12.3.1fixed
Suseflacopenstack cloud 81.3.0-12.3.1fixed
Suseflacopenstack cloud 91.3.0-12.3.1fixed
Suseflacopenstack cloud crowbar 81.3.0-12.3.1fixed
Suseflacopenstack cloud crowbar 91.3.0-12.3.1fixed
Suseflaclinux enterprise server for sap applications 12 sp21.3.0-12.3.1fixed
Suseflaclinux enterprise server for sap applications 12 sp31.3.0-12.3.1fixed
Suseflaclinux enterprise server for sap applications 12 sp41.3.0-12.3.1fixed
Suseflaclinux enterprise software development kit 12 sp51.3.0-12.3.1fixed
Suseflaclinux enterprise server 12 sp2-ltss1.3.0-12.3.1fixed
Suseflaclinux enterprise server 12 sp2-bcl1.3.0-12.3.1fixed
Suseflaclinux enterprise server 12 sp3-ltss1.3.0-12.3.1fixed
Suseflaclinux enterprise server 12 sp3-bcl1.3.0-12.3.1fixed
Suseflaclinux enterprise server 12 sp4-ltss1.3.0-12.3.1fixed
Suseflaclinux enterprise server 12 sp51.3.0-12.3.1fixed
Suseflaclinux enterprise server for sap applications 12 sp51.3.0-12.3.1fixed
Suseflaclinux enterprise workstation extension 12 sp51.3.0-12.3.1fixed
Suseflacenterprise storage 51.3.0-12.3.1fixed
Opensuseflactumbleweed1.3.4-1.1fixed
Opensuseflacleap 15.11.3.2-lp151.4.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianflacsourcesid1.3.3-2not yet assignedNot reported[977764]
Debianflacsourceforky1.3.3-2not yet assignedNot reported[977764]
Debianflacsourcetrixie1.3.3-2not yet assignedNot reported[977764]
Debianflacsourcebookworm1.3.3-2not yet assignedNot reported[977764]
Alpineflacapk3.121.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.131.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.141.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.151.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.161.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.171.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.181.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.191.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.201.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.211.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.221.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.231.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Alpineflacapk3.241.3.4-r0Not reportedALPINE-CVE-2020-0499Not reported
Ubuntuflacdebpro1.3.1-4ubuntu0.1~esm1Not reportedUBUNTU-CVE-2020-0499Not reported
Ubuntuflacdeb18.041.3.2-1ubuntu0.1Not reportedUBUNTU-CVE-2020-0499Not reported
Ubuntuflacdeb20.041.3.3-1ubuntu0.1Not reportedUBUNTU-CVE-2020-0499Not reported
Susevlcrpmpackage hub 15 sp33.0.18-bp153.2.6.1Not reportedOPENSUSE-SU-2022:10252-1Not reported
Opensusevlcrpmleap 15.33.0.18-bp153.2.6.1Not reportedOPENSUSE-SU-2022:10252-1Not reported
Opensuseflacrpmleap 15.21.3.2-lp152.5.3.1Not reportedOPENSUSE-SU-2020:2350-1Not reported
Suseflacrpmlinux enterprise module for basesystem 15 sp11.3.2-3.6.1Not reportedSUSE-SU-2020:3933-1Not reported
Suseflacrpmlinux enterprise module for basesystem 15 sp21.3.2-3.6.1Not reportedSUSE-SU-2020:3933-1Not reported
Suseflacrpmlinux enterprise module for package hub 15 sp11.3.2-3.6.1Not reportedSUSE-SU-2020:3933-1Not reported
Suseflacrpmlinux enterprise module for package hub 15 sp21.3.2-3.6.1Not reportedSUSE-SU-2020:3933-1Not reported
Suseflacrpmlinux enterprise high performance computing 15-espos1.3.2-3.6.1Not reportedSUSE-SU-2020:3933-1Not reported
Suseflacrpmlinux enterprise high performance computing 15-ltss1.3.2-3.6.1Not reportedSUSE-SU-2020:3933-1Not reported
Suseflacrpmlinux enterprise server 15-ltss1.3.2-3.6.1Not reportedSUSE-SU-2020:3933-1Not reported
Suseflacrpmlinux enterprise server for sap applications 151.3.2-3.6.1Not reportedSUSE-SU-2020:3933-1Not reported
Opensusevlcrpmtumbleweed3.0.17-1.1Not reportedOPENSUSE-SU-2024:11951-1Not reported
Suseflacrpmhpe helion openstack 81.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmopenstack cloud 71.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmopenstack cloud 81.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmopenstack cloud 91.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmopenstack cloud crowbar 81.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmopenstack cloud crowbar 91.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server for sap applications 12 sp21.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server for sap applications 12 sp31.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server for sap applications 12 sp41.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise software development kit 12 sp51.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server 12 sp2-ltss1.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server 12 sp2-bcl1.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server 12 sp3-ltss1.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server 12 sp3-bcl1.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server 12 sp4-ltss1.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server 12 sp51.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise server for sap applications 12 sp51.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmlinux enterprise workstation extension 12 sp51.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Suseflacrpmenterprise storage 51.3.0-12.3.1Not reportedSUSE-SU-2021:0017-1Not reported
Opensuseflacrpmtumbleweed1.3.4-1.1Not reportedOPENSUSE-SU-2024:11885-1Not reported
Opensuseflacrpmleap 15.11.3.2-lp151.4.3.1Not reportedOPENSUSE-SU-2020:2348-1Not reported

[Debian bug #977764]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [flac]Unknown
    Details (2)

    • 1.4.2+ds-2 · amd64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

    • 1.4.2+ds-2 · arm64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

  • [libflac++10]Unknown

    Source package: [flac]

    Details (2)

    • 1.4.2+ds-2 · amd64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

    • 1.4.2+ds-2 · arm64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

  • [libflac12]Unknown

    Source package: [flac]

    Details (2)

    • 1.4.2+ds-2 · amd64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

    • 1.4.2+ds-2 · arm64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

  • [libflac++-dev]Unknown

    Source package: [flac]

    Details (2)

    • 1.4.2+ds-2 · amd64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

    • 1.4.2+ds-2 · arm64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

  • [libflac-dev]Unknown

    Source package: [flac]

    Details (2)

    • 1.4.2+ds-2 · amd64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

    • 1.4.2+ds-2 · arm64 · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

  • [libflac-doc]Unknown

    Source package: [flac]

    Details (2)

    • 1.4.2+ds-2 · all · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

    • 1.4.2+ds-2 · all · bookworm

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · bookworm; dsa · flac · debian · 12

[Debian 13 (Trixie)]

  • [flac]Unknown
    Details (2)

    • 1.5.0+ds-2 · amd64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

    • 1.5.0+ds-2 · arm64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

  • [libflac++11]Unknown

    Source package: [flac]

    Details (2)

    • 1.5.0+ds-2 · amd64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

    • 1.5.0+ds-2 · arm64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

  • [libflac14]Unknown

    Source package: [flac]

    Details (2)

    • 1.5.0+ds-2 · amd64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

    • 1.5.0+ds-2 · arm64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

  • [libflac++-dev]Unknown

    Source package: [flac]

    Details (2)

    • 1.5.0+ds-2 · amd64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

    • 1.5.0+ds-2 · arm64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

  • [libflac-dev]Unknown

    Source package: [flac]

    Details (2)

    • 1.5.0+ds-2 · amd64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

    • 1.5.0+ds-2 · arm64 · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

  • [libflac-doc]Unknown

    Source package: [flac]

    Details (2)

    • 1.5.0+ds-2 · all · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

    • 1.5.0+ds-2 · all · trixie

      Fixed · Fixed: 1.3.3-2

      dsa · flac · debian · 13

[openSUSE Tumbleweed]

  • [flac]Unknown

    Source package: [flac]

    Details (1)

    • 1.5.0-1.6 · x86_64 · tumbleweed

      Fixed · Fixed: 1.3.4-1.1

      dsa · flac · opensuse · tumbleweed

  • [flac-devel]Unknown

    Source package: [flac]

    Details (1)

    • 1.5.0-1.6 · x86_64 · tumbleweed

      Unknown · Fixed: 1.3.4-1.1

      Version impact unknown

      dsa · flac · opensuse · tumbleweed

  • [flac-devel-32bit]Unknown

    Source package: [flac]

    Details (1)

    • 1.5.0-1.6 · x86_64 · tumbleweed

      Unknown · Fixed: 1.3.4-1.1

      Version impact unknown

      dsa · flac · opensuse · tumbleweed

  • [libFLAC++11]Unknown

    Source package: [flac]

    Details (1)

    • 1.5.0-1.6 · x86_64 · tumbleweed

      Unknown · Fixed: 1.3.4-1.1

      Version impact unknown

      dsa · flac · opensuse · tumbleweed

  • [libFLAC++11-32bit]Unknown

    Source package: [flac]

    Details (1)

    • 1.5.0-1.6 · x86_64 · tumbleweed

      Unknown · Fixed: 1.3.4-1.1

      Version impact unknown

      dsa · flac · opensuse · tumbleweed

  • [libFLAC++11-x86-64-v3]Unknown

    Source package: [flac]

    Details (1)

    • 1.5.0-1.6 · x86_64 · tumbleweed

      Unknown · Fixed: 1.3.4-1.1

      Version impact unknown

      dsa · flac · opensuse · tumbleweed

  • [libFLAC14]Unknown

    Source package: [flac]

    Details (1)

    • 1.5.0-1.6 · x86_64 · tumbleweed

      Unknown · Fixed: 1.3.4-1.1

      Version impact unknown

      dsa · flac · opensuse · tumbleweed

  • [libFLAC14-32bit]Unknown

    Source package: [flac]

    Details (1)

    • 1.5.0-1.6 · x86_64 · tumbleweed

      Unknown · Fixed: 1.3.4-1.1

      Version impact unknown

      dsa · flac · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]