CVE-2007-6278: FLAC doesn't enforce a MIME type for image referenced by URL

Severity: Critical

CVSS Score: 9.3

Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to download arbitrary files via the MIME-Type URL flag (-->) for the FLAC image file in a crafted .FLAC file.