Logo
›
›component›faad2
Name
faad2
Version
2.8.8
Type
library
Description
An open source MPEG-4 and MPEG-2 AAC decoding library
Licenses
GPL-2.0-only
PURL
-
CPE
cpe:2.3:*:*:faad2:2.8.8:*:*:*:*:*:*:*

Other Versions#

Project
Branch
Version
yocto
master
2.11.2+git
yocto
scarthgap
2.11.1+git

Patches#

#
Title
Author
Resolve
1
Restrict SBR frame length to 960 and 1024 samples.
Andrew Wesie <awesie@gmail.com>
CVE-2021-32274
CVE-2021-32277
2
fix heap-buffer-overflow in mp4read.c
Fabian Greffrath <fabian@greffrath.com>
CVE-2021-32272
3
mp4read.c: fix stack-buffer-overflow in stringin()/ftypin()
Fabian Greffrath <fabian@greffrath.com>
CVE-2021-32273
4
Check for error after each channel decode.
Andrew Wesie <awesie@gmail.com>
CVE-2021-32276
5
Check for inconsistent number of channels.
Andrew Wesie <awesie@gmail.com>
CVE-2021-32276
6
Check return value of ltp_data.
Andrew Wesie <awesie@gmail.com>
CVE-2021-32278

Vulnerabilities#

Name
Analysis
Description
CVE-2021-32278
Patched
An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function lt_prediction located in lt_predict.c. It allows an attacker to cause code Execution.
CVE-2021-32277
Patched
An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVE-2021-32276
Patched
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
CVE-2021-32274
Patched
An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVE-2021-32273
Patched
An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the function ftypin located in mp4read.c. It allows an attacker to cause Code Execution.
CVE-2021-32272
Patched
An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code Execution.