Buffer overflow in faac (Alpine package)
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-19886 |
| CWE-ID | CWE-119 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
weechat (Alpine package) Operating systems & Components / Operating system package or component faac (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Buffer overflow
EUVDB-ID: #VU33005
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-19886
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 8 case.
MitigationInstall update from vendor's website.
Vulnerable software versionsweechat (Alpine package): 2.1-r0 - 2.7.1-r1
faac (Alpine package): 1.28-r12 - 1.30-r0
CPE2.3- cpe:2.3:a:alpine:weechat_alpine_package:2.1-r0:*:*:*:*:alpine_linux:*:3.8
- cpe:2.3:a:alpine:weechat_alpine_package:2.2-r0:*:*:*:*:alpine_linux:*:3.8
- cpe:2.3:a:alpine:weechat_alpine_package:2.3-r0:*:*:*:*:alpine_linux:*:3.9
- cpe:2.3:a:alpine:faac_alpine_package:1.28-r12:*:*:*:*:alpine_linux:*:3.9
- cpe:2.3:a:alpine:faac_alpine_package:1.29.9.2-r0:*:*:*:*:alpine_linux:*:3.9
- cpe:2.3:a:alpine:faac_alpine_package:1.30-r0:*:*:*:*:alpine_linux:*:3.10
https://git.alpinelinux.org/aports/commit/?id=e0d69f194820956a67e4e9e2a8953242766cca85
https://git.alpinelinux.org/aports/commit/?id=239bf4e180913a772d25a7dfa70fa8c3e97c8bdb
https://git.alpinelinux.org/aports/commit/?id=d26ce7440e932bc093367b9d534ea858e1e3db71
https://git.alpinelinux.org/aports/commit/?id=5c54dd554588857a41293c417766f3ca912eed3b
https://git.alpinelinux.org/aports/commit/?id=959bbf312f51a2082438b065a1da3ed6b3e852ee
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
