Global-buffer-overflow in iaace_estimate_scfs_chan in libxaac
Summary
OSV-2023-1231: Global-buffer-overflow in iaace_estimate_scfs_chan. Affects libxaac versions >= 695799b8b696425a0c1afbc829a4b8da3bdd315e, < 86eb72d8eb5c8c2cc0a667a8646068d11e0bbae3. Fixed in 86eb72d8eb5c8c2cc0a667a8646068d11e0bbae3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxaac is an open-source library that provides encoding and decoding functionality for the Advanced Audio Coding (AAC) format. It is widely used in various applications for audio processing. However, a global-buffer-overflow vulnerability has been discovered in the iaace_estimate_scfs_chan function of libxaac. This vulnerability can be triggered when processing certain input data, leading to a read overflow of 4 bytes. The vulnerability was reported through the OSS-Fuzz project.
Vulnerability Detail
The global-buffer-overflow vulnerability in iaace_estimate_scfs_chan can be exploited by an attacker to read beyond the bounds of a buffer. This can potentially result in the disclosure of sensitive information or the execution of arbitrary code. The vulnerability occurs in the ia_enhaacplus_enc_qc_main and ia_enhaacplus_enc_aac_core_encode functions. The issue was introduced in commit 695799b8b696425a0c1afbc829a4b8da3bdd315e and was fixed in commit 86eb72d8eb5c8c2cc0a667a8646068d11e0bbae3.
How To Fix
Minimum fixed version
86eb72d8eb5c8c2cc0a667a8646068d11e0bbae3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as soon as possible.
Conclusion
The global-buffer-overflow vulnerability in iaace_estimate_scfs_chan in libxaac can lead to the execution of arbitrary code or the disclosure of sensitive information. It is crucial to update the library to a version that includes the fix to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libxaac →
FAQ
libxaac is an open-source library that provides encoding and decoding functionality for the Advanced Audio Coding (AAC) format.
A global-buffer-overflow vulnerability occurs when a program tries to read or write data outside the bounds of a buffer, potentially leading to memory corruption or arbitrary code execution.
This vulnerability can be exploited by providing specially crafted input data to trigger the buffer overflow and potentially execute arbitrary code or disclose sensitive information.
Yes, this vulnerability has been fixed in commit 86eb72d8eb5c8c2cc0a667a8646068d11e0bbae3 of the libxaac library.
You can update libxaac to the fixed version by using the package manager or manually updating the source code to include the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxaac.
