Heap Buffer Overflow in fdkaac Package: CVE-2022-37781
Summary
DEBIAN-CVE-2022-37781: fdkaac v1.0.3 was discovered to contain a heap buffer overflow via __interceptor_memcpy.part.46 at /sanitizer_common/sanitizer_common_interceptors.inc. Affects fdkaac versions < 1.0.6-0.1. Fixed in 1.0.6-0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fdkaac package is an open-source audio encoder that provides high-quality AAC encoding. It is widely used in various multimedia applications due to its efficiency and performance. However, versions prior to 1.0.6-0.1 are vulnerable to a heap buffer overflow, which can lead to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2022-37781 is a heap buffer overflow found in fdkaac version 1.0.3. This issue arises from the improper handling of memory during the execution of the __interceptor_memcpy.part.46 function, which can allow an attacker to exploit the overflow, potentially leading to arbitrary code execution or application crashes. The vulnerability is classified as having unimportant urgency, but it still poses a risk to systems using the affected versions of the package.
How To Fix
Minimum fixed version
1.0.6-0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fdkaacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected version of fdkaac (1.0.3) and instead use an earlier version that does not have the vulnerability. However, this is not a long-term solution and updating to the patched version is strongly recommended.
Conclusion
The fdkaac package has a critical vulnerability (CVE-2022-37781) that can lead to serious security implications. Users are advised to update to the patched version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for fdkaac →
FAQ
CVE-2022-37781 is a vulnerability in the fdkaac package that allows for a heap buffer overflow, potentially leading to security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution or crashes in applications using the affected fdkaac package.
Yes, a patched version of the fdkaac package (1.0.6-0.1) is available, which resolves the vulnerability.
If immediate updates are not possible, consider using an earlier version of fdkaac that does not contain the vulnerability as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for fdkaac.
