Denial of Service Vulnerability in FAAD2 Package - CVE-2018-20198
Summary
ALPINE-CVE-2018-20198: A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2, or Freeware Advanced Audio Decoder, is a widely used open-source audio decoder that supports various audio formats, including AAC. It is known for its efficiency and high-quality audio output. However, certain versions of FAAD2 are vulnerable to a NULL pointer dereference, which can lead to application crashes and denial of service.
Vulnerability Detail
A NULL pointer dereference was discovered in the ifilter_bank function of libfaad/filtbank.c in FAAD2 version 2.8.8. This vulnerability can cause a segmentation fault, leading to an application crash. The mishandling of windowed output in the LONG_START_SEQUENCE case is the root cause, which can be exploited to disrupt service availability.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected features of FAAD2 until the package is updated. However, this may limit functionality and is not a permanent solution.
Conclusion
The FAAD2 package has a critical vulnerability (CVE-2018-20198) that can lead to denial of service. It is essential to update to the patched version 2.9.0-r0 to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for faad2 →
FAQ
CVE-2018-20198 is a vulnerability in the FAAD2 package that can lead to a denial of service due to a NULL pointer dereference.
If your application uses an affected version of FAAD2, it may crash when processing certain audio files, leading to service interruptions.
FAAD2 versions prior to 2.9.0-r0 are affected by this vulnerability.
Yes, you can use Vulert to monitor your application for open-source vulnerabilities in real-time without needing to access the code or installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
