Stack Overflow Vulnerability in fdkaac Package
Summary
DEBIAN-CVE-2023-34823: fdkaac before 1.0.5 was discovered to contain a stack overflow in read_callback function in src/main.c. Affects fdkaac versions < 1.0.6-0.1. Fixed in 1.0.6-0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fdkaac is an open-source audio codec library that provides tools for encoding and decoding audio files using the AAC (Advanced Audio Codec) format. It is widely used in various applications for its efficiency and quality in audio processing. However, prior to version 1.0.5, fdkaac was found to have a critical vulnerability that could lead to a stack overflow, potentially compromising the stability and security of applications utilizing this library.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-34823 arises from a stack overflow in the read_callback function located in src/main.c of the fdkaac package. This flaw allows an attacker to exploit the function, leading to potential arbitrary code execution or application crashes. The vulnerability affects versions of fdkaac before 1.0.5, making it crucial for users to upgrade to the patched version to mitigate risks.
How To Fix
Minimum fixed version
1.0.6-0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fdkaacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected functionality in fdkaac until the package is updated. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The fdkaac package has a critical stack overflow vulnerability that affects versions prior to 1.0.5. Users are strongly advised to update to version 1.0.6-0.1 or later to ensure their applications remain secure. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for fdkaac →
FAQ
A stack overflow occurs when a program uses more stack space than is allocated, which can lead to crashes or unexpected behavior.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for vulnerabilities.
Yes, the stack overflow vulnerability can lead to severe consequences, including arbitrary code execution and application instability.
If immediate updates are not possible, consider implementing temporary workarounds such as disabling the affected functionality until the patch can be applied.
More information about fdkaac can be found on its official repository or documentation pages, which provide details on its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for fdkaac.
