A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-faad2 | Aug 22, 2024 | Dec 18, 2018 | |
| Debian | debian-upgrade-faad2 | May 21, 2019 | Dec 18, 2018 | |
| Gentoo Linux | gentoo-linux-upgrade-media-libs-faad2 | Jun 16, 2020 | Dec 18, 2018 | |
| Ubuntu | ubuntu-pro-upgrade-faad2 | Nov 19, 2024 | Dec 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub