Alpine: multiple faad2 packages: security update to 2.9.0-r0

high Tenable Cloud Security Plugin ID 404283

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in
libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined
by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow
is later performed via getdword_n(&ld->start[words], ld->bytes_left). (CVE-2019-15296)

- An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer
overflow in the function excluded_channels() in libfaad/syntax.c. (CVE-2018-19502)

- An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer
overflow in the function calculate_gain() in libfaad/sbr_hfadj.c. (CVE-2018-19503)

- An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer
dereference in ifilter_bank() in libfaad/filtbank.c. (CVE-2018-19504)

- There is a stack-based buffer underflow in the third instance of the calculate_gain function in
libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a
denial of service or possibly unspecified other impact because limiting the additional noise energy level
is mishandled for the G_max <= G case. (CVE-2018-20194)

Plugin Details

Severity: High

ID: 404283

Version: Revision 1.27

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-15296

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 11/23/2018

Reference Information

CVE: CVE-2018-19502, CVE-2018-19503, CVE-2018-19504, CVE-2018-20194, CVE-2018-20195, CVE-2018-20196, CVE-2018-20197, CVE-2018-20198, CVE-2018-20199, CVE-2018-20357, CVE-2018-20358, CVE-2018-20359, CVE-2018-20360, CVE-2018-20361, CVE-2018-20362, CVE-2019-15296, CVE-2019-6956

Detections

Analytics