Debian update for faad2

Published: 2022-03-28

Risk	High
Patch available	YES
Number of vulnerabilities	10
CVE-ID	CVE-2018-20196 CVE-2018-20199 CVE-2018-20360 CVE-2019-6956 CVE-2021-32272 CVE-2021-32273 CVE-2021-32274 CVE-2021-32276 CVE-2021-32277 CVE-2021-32278
CWE-ID	CWE-121 CWE-476 CWE-119 CWE-125 CWE-122
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #4 is available.
Vulnerable software Subscribe	Debian Linux Operating systems & Components / Operating system faad2 (Debian package) Operating systems & Components / Operating system package or component
Vendor	Debian

Security Bulletin

This security bulletin contains information about 10 vulnerabilities.

1) Stack-based buffer overflow

EUVDB-ID: #VU16631

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-20196

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to the calculate_gain function, as defined in the libfaad/sbr_hfadj.c source code file of the affected software, mishandles the S_M array. A local attacker can submit malicious input and trigger a stack-based buffer overflow condition that causes the affected software to crash, resulting in a DoS condition.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) NULL pointer dereference

EUVDB-ID: #VU16635

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-20199

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to a NULL pointer dereference in ifilter_bank of libfaad/filtbank.c. A local attacker can trigger a segmentation fault that causes the affected software to crash, resulting in a DoS condition because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Buffer overflow

EUVDB-ID: #VU33383

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20360

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU17323

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-6956

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition.

The vulnerability exists due to a buffer over-read condition in the ps_mix_phase function, as defined in the libfaad/ps_dec.c source code file. A local attacker can submit a malicious input to the targeted system, trigger a buffer over-read condition and cause the affected application to crash.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Heap-based buffer overflow

EUVDB-ID: #VU63801

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32272

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute code on the vulnerable system.

The vulnerability exists due to a boundary error in the stszin() function located in mp4read.c. A remote attacker can trick the victim to open a specially crafted file and execute code on the vulnerable system.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Stack-based buffer overflow

EUVDB-ID: #VU63802

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32273

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the ftypin() function in mp4read.c. A remote attacker can trick the victim to open a specially crafted file and execute code on the vulnerable system.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Heap-based buffer overflow

EUVDB-ID: #VU63804

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32274

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the sbr_qmf_synthesis_64() function in sbr_qmf.c. A remote attacker can trick the victim to open a specially crafted data, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) NULL pointer dereference

EUVDB-ID: #VU63805

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32276

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in get_sample() function in output.c. A remote attacker can trick the victim to open a specially crafted data and perform a denial of service (DoS) attack.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Heap-based buffer overflow

EUVDB-ID: #VU63806

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32277

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the sbr_qmf_analysis_32() function in sbr_qmf.c. A remote attacker can trick the victim to open a specially crafted data, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Heap-based buffer overflow

EUVDB-ID: #VU63807

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32278

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open specially crafted data, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update faad2 package to version 2.10.0-1~deb10u1.

Vulnerable software versions

Debian Linux: All versions

faad2 (Debian package): before 2.10.0-1~deb10u1

External links

http://www.debian.org/security/2022/dsa-5109

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.