Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

FAAD2 2.8.8 crash can cause service outage

CVE-2018-20199 · published 7 years ago
Summary

The free audio decoder FAAD2 version 2.8.8 can stop working when it processes certain audio data, causing the program to crash. This crash prevents the application from continuing, effectively denying service to users. Update to a newer FAAD2 release or switch to an alternative decoder to avoid the issue.

What to do
  • Update audiocoding freeware_advanced_audio_decoder_2 to version 2.9.0 or later.
Affected software
VendorProductAffected versions
audiocoding freeware_advanced_audio_decoder_2 < 2.9.0
cpe:2.3:a:audiocoding:freeware_advanced_audio_decoder_2:*:*:*:*:*:*:*:*
debian debian_linux 8.0
9.0
10.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Original advisory text
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application cra...
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published18 Dec 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-20199 · NVD
Track software like this
Free during beta