PT-2018-3068 · Freeware+1 · Faad2+1
Fantasy7082
·
Publicado
2018-11-23
·
Atualizado
2025-07-03
·
CVE-2018-20194
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Freeware Advanced Audio Decoder 2 (FAAD2) version 2.8.8
Description
The issue is related to a stack-based buffer underflow in the calculate gain function, specifically in the third instance of this function in libfaad/sbr hfadj.c. This underflow occurs due to the mishandling of the additional noise energy level when G max is less than or equal to G. A crafted input can lead to a denial of service or possibly other unspecified impacts. The vulnerability may allow an attacker to compromise data integrity, gain unauthorized access to protected information, and cause a denial of service.
Recommendations
For Freeware Advanced Audio Decoder 2 (FAAD2) version 2.8.8, as a temporary workaround, consider disabling the
calculate gain function until a patch is available. Restrict access to the libfaad/sbr hfadj.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Memory Corruption
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Faad2