Vulnerability in faad2 - Security Update
Summary
DLA-1077-1: faad2 - security update. Affects faad2 versions < 2.7-8+deb7u1. Fixed in 2.7-8+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
faad2 is a fast audio decoder used to decode MPEG-4 and MPEG-2 Advanced Audio Coding (AAC) formats. It is widely used in various applications to play audio files. However, a security issue has been discovered in faad2 that could allow remote attackers to cause a denial of service (DoS) attack. This vulnerability can be exploited by sending a crafted mp4 file to the application, leading to memory failures or excessive CPU consumption.
Vulnerability Detail
The vulnerability in faad2 arises from various security issues, including CVE-2017-9218, CVE-2017-9219, CVE-2017-9220, CVE-2017-9221, CVE-2017-9222, CVE-2017-9223, CVE-2017-9253, CVE-2017-9254, CVE-2017-9255, CVE-2017-9256, and CVE-2017-9257. These vulnerabilities can be exploited remotely by an attacker who sends a specially crafted mp4 file to the vulnerable application. The consequences of successful exploitation include application crashes due to memory failures or excessive CPU consumption.
How To Fix
Minimum fixed version
2.7-8+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, faad2 is vulnerable to various security issues that can be exploited remotely to cause a denial of service attack. To mitigate this vulnerability, it is crucial to upgrade the faad2 package to version 2.7-8+deb7u1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for faad2 →
FAQ
faad2 is a fast audio decoder used to decode MPEG-4 and MPEG-2 Advanced Audio Coding (AAC) formats. It is commonly used in various applications to play audio files.
The vulnerability in faad2 can allow remote attackers to cause a denial of service (DoS) attack by sending a specially crafted mp4 file. This can lead to application crashes due to memory failures or excessive CPU consumption.
To fix the vulnerability, it is recommended to upgrade the faad2 package to version 2.7-8+deb7u1 or later. This can be done by updating the package using the package manager of the Debian 7 Wheezy distribution.
No specific workarounds have been mentioned for this vulnerability. It is recommended to apply the security update as soon as possible.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
