There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in
    libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined
    by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow
    is later performed via getdword_n(&ld->start[words], ld->bytes_left). (CVE-2019-15296)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer
    overflow in the function excluded_channels() in libfaad/syntax.c. (CVE-2018-19502)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer
    overflow in the function calculate_gain() in libfaad/sbr_hfadj.c. (CVE-2018-19503)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer
    dereference in ifilter_bank() in libfaad/filtbank.c. (CVE-2018-19504)

  - There is a stack-based buffer underflow in the third instance of the calculate_gain function in
    libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a
    denial of service or possibly unspecified other impact because limiting the additional noise energy level
    is mishandled for the G_max <= G case. (CVE-2018-20194)

Multiple vulnerabilities have been found in faad2, the Freeware Advanced Audio Coder :

CVE-2018-20194 CVE-2018-20197

Improper handling of implicit channel mapping reconfiguration leads to multiple heap based buffer overflow issues. These flaws might be leveraged by remote attackers to cause DoS.

CVE-2018-20198 CVE-2018-20362

Insufficient user input validation in the sbr_hfadj module leads to stack-based buffer underflow issues. These flaws might be leveraged by remote attackers to cause DoS or any other unspecified impact.

For Debian 8 'Jessie', these problems have been fixed in version 2.7-8+deb8u2.

We recommend that you upgrade your faad2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio     Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash because     adding to windowed output is mishandled in the EIGHT_SHORT_SEQUENCE case. (CVE-2018-20362)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202006-17 (FAAD2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FAAD2. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in faad2, the Freeware Advanced Audio Coder. These vulnerabilities might allow remote attackers to cause denial-of-service, or potentially execute arbitrary code if crafted MPEG AAC files are processed.

ID	Name	Product	Family	Published	Updated	Severity
404283	Alpine: multiple faad2 packages: security update to 2.9.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
404283	Alpine: multiple faad2 packages: security update to 2.9.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
125267	Debian DLA-1791-1 : faad2 security update	Nessus	Debian Local Security Checks	5/20/2019	5/21/2024	high
250535	Linux Distros Unpatched Vulnerability : CVE-2018-20362	Nessus	Misc.	8/18/2025	8/18/2025	medium
137454	GLSA-202006-17 : FAAD2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/17/2020	3/7/2024	high
128782	Debian DSA-4522-1 : faad2 - security update	Nessus	Debian Local Security Checks	9/16/2019	4/26/2024	high

Detections

Analytics

Plugins Search

high

high

high

medium

high

high