Buffer Over-read Vulnerability in FAAD2 Package
Summary
ALPINE-CVE-2019-6956: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2 (Freeware Advanced Audio Decoder) is an open-source audio decoder that supports various audio formats, including AAC. It is widely used in multimedia applications for its efficiency and performance. However, versions prior to 2.9.0-r0 are susceptible to a buffer over-read vulnerability, which can lead to potential data exposure.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2019-6956 is a buffer over-read in the ps_mix_phase function located in libfaad/ps_dec.c. This issue arises from improper handling of audio data, allowing an attacker to read beyond the intended memory boundaries. The ramifications of this vulnerability include potential exposure of sensitive data and application crashes, which could be exploited by malicious actors.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the application or disabling features that utilize the affected FAAD2 package until the update can be applied.
Conclusion
The buffer over-read vulnerability in the FAAD2 package poses significant risks to applications that utilize it. It is crucial to update to the patched version 2.9.0-r0 or later to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for faad2 →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
FAAD2 versions prior to 2.9.0-r0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include data exposure and application crashes, which can be exploited by attackers.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
