PT-2018-3818 · Audiocoding+2 · Faad2+2

Fishfish · Published 2018-11-23 · Updated 2025-07-03 · CVE-2019-6956

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Freeware Advanced Audio Decoder 2 (FAAD2) versions 2.8.8

Description The issue is related to a buffer over-read in the ps mix phase function of the libfaad/ps dec.c component of the Freeware Advanced Audio Decoder 2 (FAAD2) audio decoder. This is due to the lack of checking of the iid index. Exploitation of this issue allows a remote attacker to access confidential data and cause a denial of service.

Recommendations For version 2.8.8, consider disabling the ps mix phase function as a temporary workaround until a patch is available. Restrict access to the libfaad/ps dec.c component to minimize the risk of exploitation. Avoid using the iid index variable in the affected function until the issue is resolved.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2021-1228

ALT-PU-2021-1316

ALT-PU-2021-1341

ALT-PU-2023-1579

BDU:2022-05764

CVE-2019-6956

DLA-1899-1

DLA-2792-1

DSA-5109-1

MGASA-2019-0215

OPENSUSE-SU-2025:15214-1

Affected Products

Alt Linux

Astra Linux

Faad2

References · 41

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/faad/global-buffer-overflow%40ps_mix_phase.md · Exploit
• https://security.gentoo.org/glsa/202006-17 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15214-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1899-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0215.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2792-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6956 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://debian.org/security/2022/dsa-5109 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-6956 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6956 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0215 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6956 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6956 · Vendor Advisory