Vulnerability Description
In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Android | 11.0 | |
| Debian | Debian Linux | 9.0 |
| Fedoraproject | Fedora | 32 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430
- https://lists.debian.org/debian-lts-announce/2021/01/msg00001.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://source.android.com/security/bulletin/pixel/2020-12-01Vendor Advisory
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430
- https://lists.debian.org/debian-lts-announce/2021/01/msg00001.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://source.android.com/security/bulletin/pixel/2020-12-01Vendor Advisory
FAQ
What is CVE-2020-0499?
CVE-2020-0499 is a vulnerability with a CVSS score of 4.3 (MEDIUM). In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional exec...
How severe is CVE-2020-0499?
CVE-2020-0499 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-0499?
Check the references section above for vendor advisories and patch information. Affected products include: Google Android, Debian Debian Linux, Fedoraproject Fedora.