Buffer Overflow Vulnerability in faad2: Remote Code Execution Risk
Summary
CVE-2023-38858: Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039. Affects faad2 versions < 3918dee56063500d0aa23d6c3c94b211ac471a8c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
faad2 is an open-source audio decoder that supports various audio formats, including AAC. It is widely used in multimedia applications for its efficiency and performance. However, the package has been found to have a buffer overflow vulnerability that can be exploited by attackers, leading to potential remote code execution and denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2023-38858, arises from a buffer overflow in the mp4info function located in mp4read.c at line 1039. This flaw allows a remote attacker to execute arbitrary code on the affected system, potentially leading to a complete system compromise or denial of service. The vulnerability affects multiple versions of the faad2 package across different Debian ecosystems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected application or disable the mp4info function until an upgrade can be performed. This can be done by modifying the application configuration to restrict its use.
Conclusion
CVE-2023-38858 is a critical vulnerability in the faad2 audio decoder that poses significant risks to systems using the affected versions. Users are strongly advised to upgrade to the latest version to mitigate potential threats.
See every vulnerability recorded for faad2 →
FAQ
CVE-2023-38858 is a buffer overflow vulnerability in the faad2 audio decoder that allows remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to remote code execution, allowing attackers to take control of the affected system or cause a denial of service.
The CVSS score for CVE-2023-38858 is 6.5, indicating a medium severity level.
You can mitigate the risk by limiting access to the affected application or disabling the mp4info function temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
