Buffer overflow - CVE-2018-20360
Published: December 22, 2018 / Updated: August 4, 2020
Vulnerability identifier: #VU33383
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-20360
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Affected software
Gentoo Linux
Debian Linux
faad2 (Alpine package)
faad2 (Debian package)
Debian Linux
faad2 (Alpine package)
faad2 (Debian package)
How to mitigate CVE-2018-20360
Install update from vendor's website.
faad2 (Alpine package) - update to 2.9.0-r0
faad2 (Debian package) - update to 2.10.0-1~deb10u1
faad2 (Debian package) - update to 2.10.0-1~deb10u1