Floating Point Exception in fdkaac Package: CVE-2022-36148
Summary
DEBIAN-CVE-2022-36148: fdkaac commit 53fe239 was discovered to contain a floating point exception (FPE) via wav_open at /src/wav_reader.c. Affects fdkaac versions < 1.0.6-0.1. Fixed in 1.0.6-0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fdkaac package is an open-source audio encoder that provides high-quality AAC encoding. It is widely used in various applications for audio processing due to its efficiency and performance. However, it has been identified to contain a vulnerability that can lead to a floating point exception, potentially affecting the stability of applications that rely on it.
Vulnerability Detail
The vulnerability identified as CVE-2022-36148 originates from a commit in the fdkaac codebase (commit 53fe239). It specifically affects the wav_open function located in the wav_reader.c file. This floating point exception (FPE) can lead to unexpected behavior or crashes in applications using the fdkaac package, posing a risk to system stability and reliability. The issue arises when the package processes certain audio files, which may exploit this flaw.
How To Fix
Minimum fixed version
1.0.6-0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fdkaacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing specific audio files that may trigger the floating point exception until the package is updated. Additionally, implementing input validation to check for file integrity before processing can help mitigate the risk.
Conclusion
The fdkaac package has a vulnerability (CVE-2022-36148) that can lead to floating point exceptions, affecting application stability. Users are advised to update to the patched version 1.0.6-0.1 or later to mitigate this risk. Temporary workarounds are available, but updating is the best course of action.
See every vulnerability recorded for fdkaac →
FAQ
CVE-2022-36148 is a vulnerability in the fdkaac package that can cause a floating point exception, potentially leading to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing input validation or avoiding specific audio files that may trigger the vulnerability.
The urgency of this vulnerability is classified as unimportant, but it can still affect application stability.
More information about the fdkaac package can be found in its official documentation or repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for fdkaac.
