Critical NULL Pointer Dereference in FAAD2 Package
Summary
ALPINE-CVE-2018-20362: A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2 (Freeware Advanced Audio Decoder) is an open-source audio decoder that supports various audio formats, including AAC. It is widely used in multimedia applications for decoding audio streams. The package is known for its efficiency and high-quality audio output. However, it has been identified to have a critical vulnerability that can lead to application crashes due to improper handling of certain audio sequences.
Vulnerability Detail
A NULL pointer dereference was discovered in the ifilter_bank function of libfaad/filtbank.c in FAAD2 version 2.8.8. This vulnerability can cause a segmentation fault and crash the application when processing audio data, particularly in the EIGHT_SHORT_SEQUENCE case. The issue arises from mishandling the addition to windowed output, which can be exploited to disrupt the normal operation of applications utilizing FAAD2.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid processing audio files that may trigger this vulnerability until the package is updated. Additionally, consider implementing input validation to ensure that only safe audio sequences are processed.
Conclusion
The identified NULL pointer dereference vulnerability in the FAAD2 package poses a significant risk to applications that utilize this audio decoder. It is crucial to update to the patched version to mitigate potential crashes and maintain application stability. Regular monitoring for vulnerabilities is recommended to ensure ongoing security.
See every vulnerability recorded for faad2 →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
The vulnerability affects FAAD2 versions prior to 2.9.0-r0 across multiple Alpine versions including 3.7, 3.8, 3.9, 3.10, and 3.11.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to application crashes, which may disrupt services and affect user experience.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
