Invalid Memory Address Dereference in FAAC 1.29.9.2
Summary
CVE-2018-19890: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. Affects faac across 2 version ranges.
< 1.30-1
< 389e7e5433e86bb6b24ab80086f6c5f005400ef4
Fixed in 1.30-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAC is a Freeware Advanced Audio Coder that provides audio encoding and decoding functionality. It is used to compress audio files while maintaining high quality. The vulnerability affects FAAC version 1.29.9.2 and is related to an invalid memory address dereference in the huffcode function (libfaac/huff2.c). This vulnerability can lead to a segmentation fault and application crash, resulting in a denial of service in certain cases.
Vulnerability Detail
The vulnerability (CVE-2018-19890) originates from an invalid memory address dereference in the huffcode function of FAAC. When triggered, it causes a segmentation fault and crashes the application, leading to a denial of service. This vulnerability can be exploited by an attacker to disrupt the normal functioning of the affected application. The impact of this vulnerability is limited to the book 2 case.
How To Fix
Minimum fixed version
1.30-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade faacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update FAAC to the fixed version.
Conclusion
In conclusion, the vulnerability in FAAC version 1.29.9.2 can result in a denial of service due to an invalid memory address dereference. To mitigate this risk, it is crucial to update FAAC to version 1.30-1 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for faac →
FAQ
FAAC is a Freeware Advanced Audio Coder that provides audio encoding and decoding functionality.
The vulnerability can lead to a denial of service by causing a segmentation fault and application crash in certain cases.
To fix this vulnerability, update FAAC to version 1.30-1 or later.
There is no specific workaround mentioned. Updating to the fixed version is recommended.
For more information, you can refer to the CVE-2018-19890 JSON report available at the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for faac.
