Memory Address Dereference Vulnerability in Freeware Advanced Audio Decoder 2 (FAAD2)
Summary
CVE-2018-20358: An invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 across 2 version ranges.
< 2.9.0-r0
< 334e7647a5f31903aca33dde39bb8683e9d8cccd
Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Freeware Advanced Audio Decoder 2 (FAAD2) is an open-source audio decoder library that allows decoding of various audio formats. It is widely used in applications that require audio playback or processing. However, a vulnerability has been discovered in FAAD2 that can lead to a denial of service (DoS) condition.
Vulnerability Detail
The vulnerability, identified as CVE-2018-20358, is caused by an invalid memory address dereference in the lt_prediction function of libfaad/lt_predict.c. This vulnerability can be exploited by an attacker to trigger a segmentation fault and crash the application, resulting in a DoS. The impact of this vulnerability is limited to the availability of the affected application and does not allow for remote code execution or privilege escalation.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the FAAD2 library to the patched version.
Conclusion
The memory address dereference vulnerability in FAAD2 can lead to a denial of service condition. It is crucial for users to update their FAAD2 library to version 2.9.0-r0 or later to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for faad2 →
FAQ
The vulnerability can lead to a denial of service (DoS) condition, causing the affected application to crash and become unavailable.
No, this vulnerability does not allow for remote code execution or privilege escalation. It can only be exploited by a local attacker to crash the application.
Versions of FAAD2 up to and including 2.8.8 are affected by this vulnerability.
Yes, a patch has been released in FAAD2 version 2.9.0-r0 to address this vulnerability.
No, there are no known workarounds for this vulnerability. Updating to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
