Segmentation Fault in FAAC Package Leads to Denial of Service - CVE-2018-19886
Summary
ALPINE-CVE-2018-19886: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. Affects faac versions < 1.30-r0. Fixed in 1.30-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAC (Freeware Advanced Audio Coder) is an open-source audio encoder that allows users to convert audio files into the Advanced Audio Coding (AAC) format. It is widely used due to its efficiency and quality in audio compression. However, versions prior to 1.30-r0 in Alpine Linux are vulnerable to a critical issue that can cause application crashes.
Vulnerability Detail
An invalid memory address dereference was discovered in the huffcode function located in libfaac/huff2.c of FAAC version 1.29.9.2. This vulnerability can lead to a segmentation fault, causing the application to crash and resulting in a denial of service. The issue arises from improper handling of memory addresses, which can be exploited to disrupt the normal functioning of the software.
How To Fix
Minimum fixed version
1.30-r0
This is the first release that contains the fix.
sudo apk add --upgrade faacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the specific functionality that triggers the vulnerability until the package is updated. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The FAAC package has a critical vulnerability (CVE-2018-19886) that can lead to application crashes and denial of service. Users are strongly advised to update to version 1.30-r0 or later to mitigate this risk. For those unable to update immediately, it is recommended to avoid using the affected functionality.
See every vulnerability recorded for faac →
FAQ
CVE-2018-19886 is a vulnerability in the FAAC package that causes a segmentation fault, leading to a denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of severity.
If you cannot update the package right away, avoid using the affected functionality as a temporary workaround.
You can visit Vulert at https://vulert.com for real-time monitoring and alerts on open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for faac.
