CVE-2007-6278

Published: 7 December 2007

Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to download arbitrary files via the MIME-Type URL flag (-->) for the FLAC image file in a crafted .FLAC file.

Notes

checked diff from 1.2.0 to 1.2.1 and found the mime parts. These
were included in the fix for CVE-2007-4619 for gutsy. 1.1.2 does not
have the mime code in libFLAC
note that CVE-2007-4619 was very general and came out before the
iDefense CVEs, so there is overlap

Status

References

• https://www.cve.org/CVERecord?id=CVE-2007-6278
• NVD
• Launchpad
• Debian