CVE-2007-4619

Estado: ModificadaAlta (9.3)—
Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow.
CVSS

Versión: 2.0
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Puntuación base: 9.3
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 6.75%
Percentil entre todas las CVEs puntuadas: 94
Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)

Flac — Libflac Nullsoft — Winamp
CWE

CWE-189
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-4619",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-12T21:17:00.000",
  "references": [
    {
      "url": "http://bugzilla.redhat.com/show_bug.cgi?id=331991",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://flac.sourceforge.net/changelog.html#flac_1_2_1",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27210",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27223",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27355",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27399",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27507",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27601",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27625",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27628",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27780",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27878",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28548",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200711-15.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1018815",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1469",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:214",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0975.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26042",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-540-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3483",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3484",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/4061",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=332571",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37187",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://issues.rpath.com/browse/RPL-1873",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10571",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bugzilla.redhat.com/show_bug.cgi?id=331991",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://flac.sourceforge.net/changelog.html#flac_1_2_1",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27210",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27223",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27355",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27399",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27507",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27601",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27625",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27628",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27780",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27878",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28548",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200711-15.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1018815",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0243",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1469",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:214",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0975.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26042",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-540-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3483",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3484",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/4061",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=332571",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37187",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://issues.rpath.com/browse/RPL-1873",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10571",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00035.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow."
    },
    {
      "lang": "es",
      "value": "Múltiples desbordamientos de entero en Free Lossless Audio Codec (FLAC) libFLAC versiones anteriores a 1.2.1, como se usan Winamp versiones anteriores a 5.5 y otros productos, permiten a atacantes remotos con la complicidad del usuario ejecutar código de su elección mediante un fichero FLAC malformado que dispara una ubicación de memoria inapropiada, resultando en un desbordamiento de búfer basado en montículo."
    }
  ],
  "lastModified": "2026-06-16T22:44:26.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:flac:libflac:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D389BAA-4D7C-4126-8D3D-9C8286BDBB45",
              "versionEndIncluding": "1.2"
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "366727E0-07BA-4D81-8EB2-7B291722C558",
              "versionEndIncluding": "5.35"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}