CVE-2019-15296

Name
CVE-2019-15296
Description
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow is later performed via getdword_n(&ld->start[words], ld->bytes_left).
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174
Third Party Advisory https://lists.debian.org/debian-lts-announce/2019/08/msg00033.html
DEBIAN https://www.debian.org/security/2019/dsa-4522
BUGTRAQ https://seclists.org/bugtraq/2019/Sep/28
GENTOO https://security.gentoo.org/glsa/202006-17

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:audiocoding:freeware_advanced_audio_decoder_2:2.8.8:*:*:*:*:*:*:* freeware_advanced_audio_decoder_2 == None == 2.8.8

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
faad2 3.10-main 2.9.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed