There is a stack-based buffer overflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the S_M array is mishandled.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There is a stack-based buffer overflow in the third instance of the calculate_gain function in     libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a     denial of service or possibly unspecified other impact because the S_M array is mishandled.
    (CVE-2018-20196)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in
    libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined
    by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow
    is later performed via getdword_n(&ld->start[words], ld->bytes_left). (CVE-2019-15296)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer
    overflow in the function excluded_channels() in libfaad/syntax.c. (CVE-2018-19502)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer
    overflow in the function calculate_gain() in libfaad/sbr_hfadj.c. (CVE-2018-19503)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer
    dereference in ifilter_bank() in libfaad/filtbank.c. (CVE-2018-19504)

  - There is a stack-based buffer underflow in the third instance of the calculate_gain function in
    libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a
    denial of service or possibly unspecified other impact because limiting the additional noise energy level
    is mishandled for the G_max <= G case. (CVE-2018-20194)

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5109 advisory.

  - There is a stack-based buffer overflow in the third instance of the calculate_gain function in     libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a     denial of service or possibly unspecified other impact because the S_M array is mishandled.
    (CVE-2018-20196)

  - A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio     Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads     to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
    (CVE-2018-20199)

  - An invalid memory address dereference was discovered in the sbr_process_channel function of     libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a     segmentation fault and application crash, which leads to denial of service. (CVE-2018-20360)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in     ps_mix_phase in libfaad/ps_dec.c. (CVE-2019-6956)

  - An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin     located in mp4read.c. It allows an attacker to cause Code Execution. (CVE-2021-32272)

  - An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the function ftypin     located in mp4read.c. It allows an attacker to cause Code Execution. (CVE-2021-32273)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution. (CVE-2021-32274)

  - An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function     get_sample() located in output.c. It allows an attacker to cause Denial of Service. (CVE-2021-32276)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker to cause code Execution. (CVE-2021-32277)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     lt_prediction located in lt_predict.c. It allows an attacker to cause code Execution. (CVE-2021-32278)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202006-17 (FAAD2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FAAD2. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in faad2, the Freeware Advanced Audio Coder :

CVE-2018-19502

Heap buffer overflow in the function excluded_channels (libfaad/syntax.c). This vulnerability might allow remote attackers to cause denial of service via crafted MPEG AAC data.

CVE-2018-20196

Stack buffer overflow in the function calculate_gain (libfaad/br_hfadj.c). This vulnerability might allow remote attackers to cause denial of service or any unspecified impact via crafted MPEG AAC data.

CVE-2018-20199 CVE-2018-20360

NULL pointer dereference in the function ifilter_bank (libfaad/filtbank.c). This vulnerability might allow remote attackers to cause denial of service via crafted MPEG AAC data.

CVE-2019-6956

Global buffer overflow in the function ps_mix_phase (libfaad/ps_dec.c). This vulnerability might allow remote attackers to cause denial of service or any other unspecified impact via crafted MPEG AAC data.

CVE-2019-15296

Buffer overflow in the function faad_resetbits (libfaad/bits.c). This vulnerability might allow remote attackers to cause denial of service via crafted MPEG AAC data.

For Debian 8 'Jessie', these problems have been fixed in version 2.7-8+deb8u3.

We recommend that you upgrade your faad2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
250614	Linux Distros Unpatched Vulnerability : CVE-2018-20196	Nessus	Misc.	high
404283	Alpine: multiple faad2 packages: security update to 2.9.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404283	Alpine: multiple faad2 packages: security update to 2.9.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
160000	Debian DSA-5109-1 : faad2 - security update	Nessus	Debian Local Security Checks	high
137454	GLSA-202006-17 : FAAD2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
128305	Debian DLA-1899-1 : faad2 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-20196

high

Tenable Plugins

high

high

high

high

high

high