Critical NULL Pointer Dereference in FAAD2 Package Leading to Denial of Service
Summary
ALPINE-CVE-2018-20195: A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2 (Freeware Advanced Audio Decoder) is an open-source audio decoder that is widely used for decoding Advanced Audio Coding (AAC) files. It is known for its efficiency and high-quality audio playback. However, versions prior to 2.9.0-r0 contain a vulnerability that can lead to application crashes, making it susceptible to denial of service attacks.
Vulnerability Detail
A NULL pointer dereference was discovered in the 'ic_predict' function of the 'libfaad/ic_predict.c' file in FAAD2 version 2.8.8. This vulnerability can cause a segmentation fault, leading to an application crash. The issue arises when the decoder attempts to process certain audio files, resulting in a denial of service. The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation to prevent the decoder from processing potentially harmful audio files. This can help mitigate the risk of triggering the vulnerability.
Conclusion
The FAAD2 package has a critical vulnerability that can lead to denial of service due to a NULL pointer dereference. It is essential to update to the patched version 2.9.0-r0 to ensure the security and stability of applications using this decoder. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for faad2 →
FAQ
The vulnerability can lead to application crashes, resulting in denial of service for users relying on the FAAD2 decoder.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
FAAD2 versions prior to 2.9.0-r0 are affected by this vulnerability.
Yes, implementing input validation can help prevent the decoder from processing harmful audio files.
The CVSS score of this vulnerability is 5.5, indicating a moderate risk level.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
