There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in
    libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined
    by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow
    is later performed via getdword_n(&ld->start[words], ld->bytes_left). (CVE-2019-15296)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer
    overflow in the function excluded_channels() in libfaad/syntax.c. (CVE-2018-19502)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer
    overflow in the function calculate_gain() in libfaad/sbr_hfadj.c. (CVE-2018-19503)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer
    dereference in ifilter_bank() in libfaad/filtbank.c. (CVE-2018-19504)

  - There is a stack-based buffer underflow in the third instance of the calculate_gain function in
    libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a
    denial of service or possibly unspecified other impact because limiting the additional noise energy level
    is mishandled for the G_max <= G case. (CVE-2018-20194)

The remote host is affected by the vulnerability described in GLSA-202006-17 (FAAD2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FAAD2. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer     overflow in the function calculate_gain() in libfaad/sbr_hfadj.c. (CVE-2018-19503)

Note that Nessus relies on the presence of the package as reported by the vendor.

Multiple vulnerabilities have been discovered in faad2, the Freeware Advanced Audio Coder. These vulnerabilities might allow remote attackers to cause denial-of-service, or potentially execute arbitrary code if crafted MPEG AAC files are processed.

ID	Name	Product	Family	Published	Updated	Severity
404283	Alpine: multiple faad2 packages: security update to 2.9.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
404283	Alpine: multiple faad2 packages: security update to 2.9.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
137454	GLSA-202006-17 : FAAD2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/17/2020	3/7/2024	high
254217	Linux Distros Unpatched Vulnerability : CVE-2018-19503	Nessus	Misc.	8/24/2025	8/24/2025	high
128782	Debian DSA-4522-1 : faad2 - security update	Nessus	Debian Local Security Checks	9/16/2019	4/26/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high