Critical Stack-Based Buffer Overflow in FAAD2 Package
Summary
ALPINE-CVE-2018-19503: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2 (Freeware Advanced Audio Decoder) is a widely used audio decoding library that supports various audio formats, including AAC. It is known for its efficiency and high-quality audio output. However, versions prior to 2.9.0-r0 are vulnerable to a stack-based buffer overflow, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from a stack-based buffer overflow in the function calculate_gain() located in libfaad/sbr_hfadj.c. This flaw can be exploited by attackers to execute arbitrary code, potentially leading to system compromise. The vulnerability has a CVSS score of 7.8, indicating a high severity level, and can be triggered through specially crafted audio files.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted audio files until the package is updated. Additionally, consider implementing input validation to mitigate the risk of exploitation.
Conclusion
The FAAD2 package has a critical vulnerability that can lead to severe security risks if not addressed. Users are strongly advised to update to the patched version 2.9.0-r0 to mitigate these risks and ensure the security of their systems.
See every vulnerability recorded for faad2 →
FAQ
The vulnerability is a stack-based buffer overflow that can be exploited through specially crafted audio files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to arbitrary code execution, which may compromise the entire system.
Yes, the patched version of FAAD2 is 2.9.0-r0. Updating to this version will resolve the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
