An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6313-1 advisory.

    It was discovered that FAAD2 incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     execute arbitrary code. (CVE-2021-32272, CVE-2021-32273, CVE-2021-32274, CVE-2021-32277, CVE-2021-32278,     CVE-2023-38857, CVE-2023-38858)

    It was discovered that FAAD2 incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. (CVE-2021-32276)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5109 advisory.

  - There is a stack-based buffer overflow in the third instance of the calculate_gain function in     libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a     denial of service or possibly unspecified other impact because the S_M array is mishandled.
    (CVE-2018-20196)

  - A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio     Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads     to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
    (CVE-2018-20199)

  - An invalid memory address dereference was discovered in the sbr_process_channel function of     libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a     segmentation fault and application crash, which leads to denial of service. (CVE-2018-20360)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in     ps_mix_phase in libfaad/ps_dec.c. (CVE-2019-6956)

  - An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin     located in mp4read.c. It allows an attacker to cause Code Execution. (CVE-2021-32272)

  - An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the function ftypin     located in mp4read.c. It allows an attacker to cause Code Execution. (CVE-2021-32273)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution. (CVE-2021-32274)

  - An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function     get_sample() located in output.c. It allows an attacker to cause Denial of Service. (CVE-2021-32276)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker to cause code Execution. (CVE-2021-32277)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     lt_prediction located in lt_predict.c. It allows an attacker to cause code Execution. (CVE-2021-32278)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2792 advisory.

  - A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio     Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads     to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
    (CVE-2018-20199)

  - An invalid memory address dereference was discovered in the sbr_process_channel function of     libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a     segmentation fault and application crash, which leads to denial of service. (CVE-2018-20360)

  - An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in     ps_mix_phase in libfaad/ps_dec.c. (CVE-2019-6956)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution. (CVE-2021-32274)

  - An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function     get_sample() located in output.c. It allows an attacker to cause Denial of Service. (CVE-2021-32276)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker to cause code Execution. (CVE-2021-32277)

  - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function     lt_prediction located in lt_predict.c. It allows an attacker to cause code Execution. (CVE-2021-32278)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
180236	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : FAAD2 vulnerabilities (USN-6313-1)	Nessus	Ubuntu Local Security Checks	high
160000	Debian DSA-5109-1 : faad2 - security update	Nessus	Debian Local Security Checks	high
154410	Debian DLA-2792-1 : faad2 - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-32274

high

Tenable Plugins

high

high

high