Segmentation Fault Vulnerability in FAAD2 Package Leading to Denial of Service
Summary
ALPINE-CVE-2018-20360: An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2 (Freeware Advanced Audio Decoder 2) is an open-source audio decoder that supports various audio formats, providing high-quality audio playback. It is widely used in multimedia applications for decoding AAC and other audio streams. However, a vulnerability has been identified in its sbr_process_channel function, which can lead to application crashes under certain conditions.
Vulnerability Detail
An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in FAAD2 version 2.8.8. This vulnerability can cause a segmentation fault, leading to an application crash and resulting in a denial of service. The issue arises from improper handling of memory addresses, which can be exploited to disrupt the normal operation of applications relying on FAAD2 for audio decoding.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected functionality of the FAAD2 package until the update is applied. Additionally, consider implementing input validation to prevent malformed audio streams from being processed.
Conclusion
The segmentation fault vulnerability in the FAAD2 package poses a significant risk of denial of service for applications utilizing this audio decoder. It is crucial to update to the patched version to mitigate this risk and ensure the stability of your applications.
See every vulnerability recorded for faad2 →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of severity.
FAAD2 versions prior to 2.9.0-r0 are affected by this vulnerability.
The vulnerability can lead to application crashes and denial of service, affecting the availability of services that rely on FAAD2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
