Secunia

Description
Multiple vulnerabilities have been reported in FLAC, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to various errors e.g. integer overflow errors, double-free errors, and boundary errors in various components when processing FLAC media files and can be exploited to cause heap-based or stack-based buffer overflows via specially-crafted FLAC media files.

Successful exploitation allows execution of arbitrary code.

The vulnerabilities are reported in version 1.2.0. Prior versions and other applications using the vulnerable library may also be affected.

Solution
Update to version 1.2.1.
Further details available in Customer Area

Provided and/or discovered by
* Sean de Regge, reported via iDefense Labs.
* Greg Linares, eEye Digital Security

Changelog
Further details available in Customer Area

Original Advisory
FLAC:
http://flac.sourceforge.net/changelog.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608

eEye:
http://research.eeye.com/html/advisories/published/AD20071115.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area