PT-2017-3886 · Freeware+1 · Faad2+1

Qflb.Wu

·

Published

2017-06-27

·

Updated

2023-04-05

·

CVE-2017-9218

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Freeware Advanced Audio Decoder 2 (FAAD2) version 2.7
Description The issue is caused by a buffer overflow in the mp4ff read stsd function, located in common/mp4ff/mp4atom.c, which can lead to a denial of service. This can be triggered by a specially crafted mp4 file, allowing an attacker to cause the application to crash due to an invalid memory read.
Recommendations For Freeware Advanced Audio Decoder 2 (FAAD2) version 2.7, consider avoiding the use of the mp4ff read stsd function until a patch is available. As a temporary workaround, restrict the processing of mp4 files to minimize the risk of exploitation.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2021-1228
ALT-PU-2021-1316
ALT-PU-2021-1341
ALT-PU-2023-1579
BDU:2019-04177
CVE-2017-9218
DLA-1077-1

Affected Products

Alt Linux
Faad2