Invalid Memory Address Dereference in Freeware Advanced Audio Decoder 2 (FAAD2)
Summary
CVE-2018-20359: An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 across 2 version ranges.
< 2.9.0-r0
< 334e7647a5f31903aca33dde39bb8683e9d8cccd
Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Freeware Advanced Audio Decoder 2 (FAAD2) is an open-source audio decoder library that allows decoding of various audio formats. It is widely used in applications that require audio playback and processing. However, a vulnerability has been discovered in FAAD2 that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2018-20359, is caused by an invalid memory address dereference in the sbrDecodeSingleFramePS function of libfaad/sbr_dec.c. This vulnerability can be exploited to trigger a segmentation fault and crash the application, resulting in a DoS condition. An attacker can potentially exploit this vulnerability to disrupt the functionality of applications that rely on FAAD2 for audio decoding.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update FAAD2 to the fixed version to mitigate the risk of exploitation.
Conclusion
The invalid memory address dereference vulnerability in FAAD2 can lead to a denial of service (DoS) attack. It is crucial for users to update their FAAD2 installation to version 2.9.0-r0 or later to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for faad2 →
FAQ
This vulnerability can lead to a denial of service (DoS) attack, causing the affected application to crash and become unresponsive.
Yes, an attacker can exploit this vulnerability remotely by sending a specially crafted audio file to the targeted application.
Yes, all versions of FAAD2 prior to 2.9.0-r0 are affected by this vulnerability.
There is no known public exploit for this vulnerability at the time of this report.
There is no evidence of active exploitation of this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
