Buffer Overflow Vulnerability in FAAD2 Package - CVE-2019-15296
Summary
ALPINE-CVE-2019-15296: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FAAD2 (Freeware Advanced Audio Decoder) is a widely used audio decoding library that supports various audio formats, particularly AAC. It is known for its high performance and accuracy in decoding audio streams. However, versions prior to 2.9.0-r0 are susceptible to a buffer overflow vulnerability that can lead to severe security risks, including potential code execution.
Vulnerability Detail
The vulnerability arises from the faad_resetbits function in libfaad/bits.c, where the number of bits to be read is calculated based on the difference between ld->buffer_size and words*4. If this calculation results in a negative value, it leads to a buffer overflow during the execution of the getdword_n function. This flaw can be exploited by attackers to manipulate memory, potentially allowing them to execute arbitrary code, leading to system compromise.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size to the faad_resetbits function to prevent negative calculations. However, this is not a permanent fix and updating the package is strongly recommended.
Conclusion
The buffer overflow vulnerability in FAAD2 (CVE-2019-15296) poses significant risks to systems using affected versions of the library. It is crucial to update to the patched version (2.9.0-r0 or later) to mitigate these risks. Users are encouraged to utilize tools like Vulert for real-time monitoring of vulnerabilities in their software.
See every vulnerability recorded for faad2 →
FAQ
CVE-2019-15296 is a buffer overflow vulnerability found in the FAAD2 audio decoding library that can lead to potential code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.8, indicating a high severity level.
If immediate updates are not possible, consider implementing input size restrictions as a temporary workaround until the package can be updated.
More information about FAAD2 can be found on its official documentation or repository, which details its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
