Critical Buffer Underflow Vulnerability in FAAD2 Package
Summary
ALPINE-CVE-2018-20197: There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2 (Freeware Advanced Audio Decoder) is an open-source audio decoder that supports various audio formats, providing high-quality audio playback. It is widely used in multimedia applications for its efficiency and performance. However, certain versions of FAAD2 are susceptible to a stack-based buffer underflow vulnerability, which can lead to severe security implications.
Vulnerability Detail
The vulnerability identified as CVE-2018-20197 arises from a stack-based buffer underflow in the calculate_gain function located in libfaad/sbr_hfadj.c of FAAD2 version 2.8.8. This flaw allows an attacker to craft specific input that can lead to a denial of service or potentially other unspecified impacts due to improper handling of additional noise energy levels when G_max exceeds G. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input to the FAAD2 decoder to prevent the processing of potentially malicious crafted inputs until the package can be updated. This can be done by implementing input validation checks in the application that utilizes FAAD2.
Conclusion
The FAAD2 package has a critical vulnerability that can lead to severe security issues if not addressed. Users are strongly advised to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for faad2 →
FAQ
CVE-2018-20197 is a vulnerability in the FAAD2 audio decoder that allows for a stack-based buffer underflow, potentially leading to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
FAAD2 versions prior to 2.9.0-r0 are affected by this vulnerability.
If an immediate update is not possible, implement input validation checks to limit the input to the FAAD2 decoder as a temporary workaround.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
