iTunes version 7.3.x suffers from a heap overflow vulnerability in the album cover parsing functionality. This has been fixed in version 7.4.
28b4a0b4a1f784dab5f1f222467ff29b633f6ffdf4df0e5380890bb5487820be
libvorbis version 1.1.2 suffers from multiple memory corruption flaws.
6f02aa2611e685524c65b81280206908251327bcdaec2f45ebded2a7edec8b0c
flac123 version 0.0.9, also known as flac-tools, is vulnerable to a buffer overflow in vorbis comment parsing. This allows for the execution of arbitrary code.
fbdbfb43d8d10a141ddcf38dde21dce4b80167794cf7f32c32d0d917efcdc4a2