Invalid Memory Address Dereference in FAAC 1.29.9.2
Summary
CVE-2018-19887: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. Affects faac across 2 version ranges.
< 1.30-1
< 389e7e5433e86bb6b24ab80086f6c5f005400ef4
Fixed in 1.30-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAC is a Freeware Advanced Audio Coder that provides audio encoding and decoding functionality. It is commonly used for compressing audio files. The vulnerability affects version 1.29.9.2 of FAAC and is related to an invalid memory address dereference in the huffcode function (libfaac/huff2.c). This vulnerability can lead to a segmentation fault and application crash, resulting in a denial of service in the book 4 case.
Vulnerability Detail
The vulnerability (CVE-2018-19887) in FAAC 1.29.9.2 is caused by an invalid memory address dereference in the huffcode function. This can be exploited by an attacker to trigger a segmentation fault and crash the application. The impact of this vulnerability is a denial of service in the book 4 case. It is important to note that this vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity.
How To Fix
Minimum fixed version
1.30-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade faacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update FAAC to the fixed version.
Conclusion
The vulnerability in FAAC 1.29.9.2, caused by an invalid memory address dereference, can result in a denial of service in the book 4 case. It is important to update FAAC to version 1.30-1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for faac →
FAQ
FAAC is a Freeware Advanced Audio Coder that provides audio encoding and decoding functionality.
The vulnerability can lead to a denial of service in the book 4 case, causing the application to crash.
The CVSSv3 score of this vulnerability is 5.5, indicating a moderate severity.
To fix this vulnerability, update FAAC to version 1.30-1 or later.
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is recommended.
Related vulnerabilities
Recent vulnerabilities recorded for faac.
