Segmentation Fault Vulnerability in FAAD2 Package - CVE-2018-20361
Summary
ALPINE-CVE-2018-20361: An invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2, or Freeware Advanced Audio Decoder, is an open-source audio decoder that supports various audio formats, particularly AAC. It is widely used in multimedia applications for its efficiency and performance. However, versions prior to 2.9.0-r0 are vulnerable to a critical issue that can lead to application crashes, affecting user experience and system stability.
Vulnerability Detail
An invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj.c in FAAD2 version 2.8.8. This vulnerability can cause a segmentation fault, leading to a denial of service as the application crashes unexpectedly. The root cause lies in improper handling of memory addresses, which can be exploited under certain conditions, potentially allowing attackers to disrupt service.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific features of FAAD2 that trigger the vulnerability until the package is updated. Additionally, running the application in a controlled environment where it can be monitored for crashes may help mitigate the impact.
Conclusion
CVE-2018-20361 represents a significant vulnerability in the FAAD2 package that can lead to application crashes and service disruptions. Users are strongly advised to update to the patched version to mitigate risks. For those unable to update immediately, temporary workarounds are available.
See every vulnerability recorded for faad2 →
FAQ
CVE-2018-20361 is a vulnerability in the FAAD2 package that can cause a segmentation fault and application crash due to an invalid memory address dereference.
Versions of FAAD2 prior to 2.9.0-r0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2018-20361 is 5.5, indicating a moderate severity level.
If an immediate update is not possible, consider implementing workarounds such as avoiding the use of vulnerable features and monitoring the application for crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
