A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.
{"debiancve": [{"lastseen": "2023-06-23T18:11:21", "description": "A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-12-18T01:29:00", "type": "debiancve", "title": "CVE-2018-20198", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20198"], "modified": "2018-12-18T01:29:00", "id": "DEBIANCVE:CVE-2018-20198", "href": "https://security-tracker.debian.org/tracker/CVE-2018-20198", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "veracode": [{"lastseen": "2022-07-27T10:35:44", "description": "faad2 is vulnerable to denial of service (DoS). A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2). The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2020-05-10T23:21:09", "type": "veracode", "title": "Denial Of Service (DoS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20198"], "modified": "2020-06-15T20:45:06", "id": "VERACODE:25226", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-25226/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "cve": [{"lastseen": "2023-06-23T14:50:25", "description": "A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-12-18T01:29:00", "type": "cve", "title": "CVE-2018-20198", "cwe": ["CWE-476"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20198"], "modified": "2020-06-15T18:15:00", "cpe": ["cpe:/a:audiocoding:freeware_advanced_audio_decoder_2:2.8.8"], "id": "CVE-2018-20198", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20198", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:audiocoding:freeware_advanced_audio_decoder_2:2.8.8:*:*:*:*:*:*:*"]}], "ubuntucve": [{"lastseen": "2023-08-09T19:27:01", "description": "A NULL pointer dereference was discovered in ifilter_bank of\nlibfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The\nvulnerability causes a segmentation fault and application crash, which\nleads to denial of service because adding to windowed output is mishandled\nin the LONG_START_SEQUENCE case.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[danielwang](<https://launchpad.net/~danielwang>) | same underlying issue as CVE-2018-20362, same fix\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2018-20198", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20198", "CVE-2018-20362"], "modified": "2018-12-18T00:00:00", "id": "UB:CVE-2018-20198", "href": "https://ubuntu.com/security/CVE-2018-20198", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "debian": [{"lastseen": "2021-10-22T12:15:14", "description": "Package : faad2\nVersion : 2.7-8+deb8u2\nCVE ID : CVE-2018-20194 CVE-2018-20197 CVE-2018-20198 CVE-2018-20362\n\nMultiple vulnerabilities have been found in faad2, the Freeware Advanced Audio\nCoder:\n\nCVE-2018-20194\nCVE-2018-20197\n\n Improper handling of implicit channel mapping reconfiguration leads to\n multiple heap based buffer overflow issues. These flaws might be leveraged\n by remote attackers to cause DoS.\n\nCVE-2018-20198\nCVE-2018-20362\n\n Insufficient user input validation in the sbr_hfadj module leads to\n stack-based buffer underflow issues. These flaws might be leveraged by\n remote attackers to cause DoS or any other unspecified impact.\n\nFor Debian 8 "Jessie", these problems have been fixed in version\n2.7-8+deb8u2.\n\nWe recommend that you upgrade your faad2 packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-05-19T13:47:05", "type": "debian", "title": "[SECURITY] [DLA 1791-1] faad2 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20194", "CVE-2018-20197", "CVE-2018-20198", "CVE-2018-20362"], "modified": "2019-05-19T13:47:05", "id": "DEBIAN:DLA-1791-1:B91E6", "href": "https://lists.debian.org/debian-lts-announce/2019/05/msg00022.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-26T15:02:39", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4522-1 security@debian.org\nhttps://www.debian.org/security/ Hugo Lefeuvre\nSeptember 15, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : faad2\nCVE ID : CVE-2018-19502 CVE-2018-19503 CVE-2018-19504 CVE-2018-20194 \n CVE-2018-20195 CVE-2018-20197 CVE-2018-20198 CVE-2018-20357 \n CVE-2018-20358 CVE-2018-20359 CVE-2018-20361 CVE-2018-20362 \n CVE-2019-15296\nDebian Bug : 914641\n\nMultiple vulnerabilities have been discovered in faad2, the Freeware Advanced\nAudio Coder. These vulnerabilities might allow remote attackers to cause\ndenial-of-service, or potentially execute arbitrary code if crafted MPEG AAC\nfiles are processed.\n\nFor the oldstable distribution (stretch), these problems have been fixed\nin version 2.8.0~cvs20161113-1+deb9u2.\n\nWe recommend that you upgrade your faad2 packages.\n\nFor the detailed security status of faad2 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/faad2\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-09-15T15:55:46", "type": "debian", "title": "[SECURITY] [DSA 4522-1] faad2 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-19502", "CVE-2018-19503", "CVE-2018-19504", "CVE-2018-20194", "CVE-2018-20195", "CVE-2018-20197", "CVE-2018-20198", "CVE-2018-20357", "CVE-2018-20358", "CVE-2018-20359", "CVE-2018-20361", "CVE-2018-20362", "CVE-2019-15296"], "modified": "2019-09-15T15:55:46", "id": "DEBIAN:DSA-4522-1:BED85", "href": "https://lists.debian.org/debian-security-announce/2019/msg00170.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-08-19T12:22:35", "description": "Multiple vulnerabilities have been found in faad2, the Freeware Advanced Audio Coder :\n\nCVE-2018-20194 CVE-2018-20197\n\nImproper handling of implicit channel mapping reconfiguration leads to multiple heap based buffer overflow issues. These flaws might be leveraged by remote attackers to cause DoS.\n\nCVE-2018-20198 CVE-2018-20362\n\nInsufficient user input validation in the sbr_hfadj module leads to stack-based buffer underflow issues. These flaws might be leveraged by remote attackers to cause DoS or any other unspecified impact.\n\nFor Debian 8 'Jessie', these problems have been fixed in version 2.7-8+deb8u2.\n\nWe recommend that you upgrade your faad2 packages.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2019-05-20T00:00:00", "type": "nessus", "title": "Debian DLA-1791-1 : faad2 security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-20194", "CVE-2018-20197", "CVE-2018-20198", "CVE-2018-20362"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:faad", "p-cpe:/a:debian:debian_linux:faad2-dbg", "p-cpe:/a:debian:debian_linux:libfaad-dev", "p-cpe:/a:debian:debian_linux:libfaad2", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DLA-1791.NASL", "href": "https://www.tenable.com/plugins/nessus/125267", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-1791-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(125267);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2018-20194\", \"CVE-2018-20197\", \"CVE-2018-20198\", \"CVE-2018-20362\");\n\n script_name(english:\"Debian DLA-1791-1 : faad2 security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple vulnerabilities have been found in faad2, the Freeware\nAdvanced Audio Coder :\n\nCVE-2018-20194 CVE-2018-20197\n\nImproper handling of implicit channel mapping reconfiguration leads to\nmultiple heap based buffer overflow issues. These flaws might be\nleveraged by remote attackers to cause DoS.\n\nCVE-2018-20198 CVE-2018-20362\n\nInsufficient user input validation in the sbr_hfadj module leads to\nstack-based buffer underflow issues. These flaws might be leveraged by\nremote attackers to cause DoS or any other unspecified impact.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n2.7-8+deb8u2.\n\nWe recommend that you upgrade your faad2 packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2019/05/msg00022.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/faad2\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:faad\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:faad2-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfaad-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfaad2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"faad\", reference:\"2.7-8+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"faad2-dbg\", reference:\"2.7-8+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libfaad-dev\", reference:\"2.7-8+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libfaad2\", reference:\"2.7-8+deb8u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-05-24T14:29:42", "description": "Multiple vulnerabilities have been discovered in faad2, the Freeware Advanced Audio Coder. These vulnerabilities might allow remote attackers to cause denial-of-service, or potentially execute arbitrary code if crafted MPEG AAC files are processed.", "cvss3": {}, "published": "2019-09-16T00:00:00", "type": "nessus", "title": "Debian DSA-4522-1 : faad2 - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-19502", "CVE-2018-19503", "CVE-2018-19504", "CVE-2018-20194", "CVE-2018-20195", "CVE-2018-20197", "CVE-2018-20198", "CVE-2018-20357", "CVE-2018-20358", "CVE-2018-20359", "CVE-2018-20361", "CVE-2018-20362", "CVE-2019-15296"], "modified": "2019-12-27T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:faad2", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-4522.NASL", "href": "https://www.tenable.com/plugins/nessus/128782", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4522. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(128782);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/12/27\");\n\n script_cve_id(\"CVE-2018-19502\", \"CVE-2018-19503\", \"CVE-2018-19504\", \"CVE-2018-20194\", \"CVE-2018-20195\", \"CVE-2018-20197\", \"CVE-2018-20198\", \"CVE-2018-20357\", \"CVE-2018-20358\", \"CVE-2018-20359\", \"CVE-2018-20361\", \"CVE-2018-20362\", \"CVE-2019-15296\");\n script_xref(name:\"DSA\", value:\"4522\");\n\n script_name(english:\"Debian DSA-4522-1 : faad2 - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple vulnerabilities have been discovered in faad2, the Freeware\nAdvanced Audio Coder. These vulnerabilities might allow remote\nattackers to cause denial-of-service, or potentially execute arbitrary\ncode if crafted MPEG AAC files are processed.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914641\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/faad2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/faad2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2019/dsa-4522\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the faad2 packages.\n\nFor the oldstable distribution (stretch), these problems have been\nfixed in version 2.8.0~cvs20161113-1+deb9u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:faad2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/11/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"faad\", reference:\"2.8.0~cvs20161113-1+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"faad2-dbg\", reference:\"2.8.0~cvs20161113-1+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfaad-dev\", reference:\"2.8.0~cvs20161113-1+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libfaad2\", reference:\"2.8.0~cvs20161113-1+deb9u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:02:15", "description": "The remote host is affected by the vulnerability described in GLSA-202006-17 (FAAD2: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in FAAD2. Please review the CVE identifiers referenced below for details.\n Impact :\n\n Please review the referenced CVE identifiers for details.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2020-06-17T00:00:00", "type": "nessus", "title": "GLSA-202006-17 : FAAD2: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-19502", "CVE-2018-19503", "CVE-2018-19504", "CVE-2018-20194", "CVE-2018-20195", "CVE-2018-20196", "CVE-2018-20197", "CVE-2018-20198", "CVE-2018-20199", "CVE-2018-20357", "CVE-2018-20358", "CVE-2018-20359", "CVE-2018-20360", "CVE-2018-20361", "CVE-2018-20362", "CVE-2019-15296", "CVE-2019-6956"], "modified": "2020-06-22T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:faad2", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-202006-17.NASL", "href": "https://www.tenable.com/plugins/nessus/137454", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 202006-17.\n#\n# The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(137454);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/06/22\");\n\n script_cve_id(\"CVE-2018-19502\", \"CVE-2018-19503\", \"CVE-2018-19504\", \"CVE-2018-20194\", \"CVE-2018-20195\", \"CVE-2018-20196\", \"CVE-2018-20197\", \"CVE-2018-20198\", \"CVE-2018-20199\", \"CVE-2018-20357\", \"CVE-2018-20358\", \"CVE-2018-20359\", \"CVE-2018-20360\", \"CVE-2018-20361\", \"CVE-2018-20362\", \"CVE-2019-15296\", \"CVE-2019-6956\");\n script_xref(name:\"GLSA\", value:\"202006-17\");\n\n script_name(english:\"GLSA-202006-17 : FAAD2: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The remote host is affected by the vulnerability described in GLSA-202006-17\n(FAAD2: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in FAAD2. Please review\n the CVE identifiers referenced below for details.\n \nImpact :\n\n Please review the referenced CVE identifiers for details.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/202006-17\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"All FAAD2 users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-libs/faad2-2.9.0'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:faad2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/11/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"media-libs/faad2\", unaffected:make_list(\"ge 2.9.0\"), vulnerable:make_list(\"lt 2.9.0\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"FAAD2\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "openvas": [{"lastseen": "2020-01-29T19:29:43", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-05-19T00:00:00", "type": "openvas", "title": "Debian LTS: Security Advisory for faad2 (DLA-1791-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-20194", "CVE-2018-20197", "CVE-2018-20198", "CVE-2018-20362"], "modified": "2020-01-29T00:00:00", "id": "OPENVAS:1361412562310891791", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891791", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891791\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2018-20194\", \"CVE-2018-20197\", \"CVE-2018-20198\", \"CVE-2018-20362\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-05-19 02:00:08 +0000 (Sun, 19 May 2019)\");\n script_name(\"Debian LTS: Security Advisory for faad2 (DLA-1791-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2019/05/msg00022.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DLA-1791-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'faad2'\n package(s) announced via the DLA-1791-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been found in faad2, the Freeware Advanced Audio\nCoder:\n\nCVE-2018-20194\nCVE-2018-20197\n\n Improper handling of implicit channel mapping reconfiguration leads to\n multiple heap based buffer overflow issues. These flaws might be leveraged\n by remote attackers to cause DoS.\n\nCVE-2018-20198\nCVE-2018-20362\n\n Insufficient user input validation in the sbr_hfadj module leads to\n stack-based buffer underflow issues. These flaws might be leveraged by\n remote attackers to cause DoS or any other unspecified impact.\");\n\n script_tag(name:\"affected\", value:\"'faad2' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', this problem has been fixed in version\n2.7-8+deb8u2.\n\nWe recommend that you upgrade your faad2 packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"faad\", ver:\"2.7-8+deb8u2\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"faad2-dbg\", ver:\"2.7-8+deb8u2\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libfaad-dev\", ver:\"2.7-8+deb8u2\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libfaad2\", ver:\"2.7-8+deb8u2\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-09-17T00:39:19", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-09-16T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 4522-1 (faad2 - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-20194", "CVE-2018-19504", "CVE-2019-15296", "CVE-2018-20195", "CVE-2018-20357", "CVE-2018-19502", "CVE-2018-20361", "CVE-2018-20197", "CVE-2018-20359", "CVE-2018-19503", "CVE-2018-20198", "CVE-2018-20358", "CVE-2018-20362"], "modified": "2019-09-16T00:00:00", "id": "OPENVAS:1361412562310704522", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704522", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704522\");\n script_version(\"2019-09-16T02:00:15+0000\");\n script_cve_id(\"CVE-2018-19502\", \"CVE-2018-19503\", \"CVE-2018-19504\", \"CVE-2018-20194\", \"CVE-2018-20195\", \"CVE-2018-20197\", \"CVE-2018-20198\", \"CVE-2018-20357\", \"CVE-2018-20358\", \"CVE-2018-20359\", \"CVE-2018-20361\", \"CVE-2018-20362\", \"CVE-2019-15296\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-09-16 02:00:15 +0000 (Mon, 16 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-09-16 02:00:15 +0000 (Mon, 16 Sep 2019)\");\n script_name(\"Debian Security Advisory DSA 4522-1 (faad2 - security update)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2019/dsa-4522.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DSA-4522-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'faad2'\n package(s) announced via the DSA-4522-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been discovered in faad2, the Freeware Advanced\nAudio Coder. These vulnerabilities might allow remote attackers to cause\ndenial-of-service, or potentially execute arbitrary code if crafted MPEG AAC\nfiles are processed.\");\n\n script_tag(name:\"affected\", value:\"'faad2' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For the oldstable distribution (stretch), these problems have been fixed\nin version 2.8.0~cvs20161113-1+deb9u2.\n\nWe recommend that you upgrade your faad2 packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"faad\", ver:\"2.8.0~cvs20161113-1+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"faad2-dbg\", ver:\"2.8.0~cvs20161113-1+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libfaad-dev\", ver:\"2.8.0~cvs20161113-1+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libfaad2\", ver:\"2.8.0~cvs20161113-1+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "osv": [{"lastseen": "2023-06-28T06:21:04", "description": "\nMultiple vulnerabilities have been found in faad2, the Freeware Advanced Audio\nCoder:\n\n\n* [CVE-2018-20194](https://security-tracker.debian.org/tracker/CVE-2018-20194), [CVE-2018-20197](https://security-tracker.debian.org/tracker/CVE-2018-20197)\nImproper handling of implicit channel mapping reconfiguration leads to\n multiple heap based buffer overflow issues. These flaws might be leveraged\n by remote attackers to cause DoS.\n* [CVE-2018-20198](https://security-tracker.debian.org/tracker/CVE-2018-20198), [CVE-2018-20362](https://security-tracker.debian.org/tracker/CVE-2018-20362)\nInsufficient user input validation in the sbr\\_hfadj module leads to\n stack-based buffer underflow issues. These flaws might be leveraged by\n remote attackers to cause DoS or any other unspecified impact.\n\n\nFor Debian 8 Jessie, these problems have been fixed in version\n2.7-8+deb8u2.\n\n\nWe recommend that you upgrade your faad2 packages.\n\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: <https://wiki.debian.org/LTS>\n\n\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-05-21T00:00:00", "type": "osv", "title": "faad2 - security update", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20194", "CVE-2018-20197", "CVE-2018-20198", "CVE-2018-20362"], "modified": "2023-06-28T06:20:59", "id": "OSV:DLA-1791-1", "href": "https://osv.dev/vulnerability/DLA-1791-1", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-21T08:23:11", "description": "\nMultiple vulnerabilities have been discovered in faad2, the Freeware Advanced\nAudio Coder. These vulnerabilities might allow remote attackers to cause\ndenial-of-service, or potentially execute arbitrary code if crafted MPEG AAC\nfiles are processed.\n\n\nFor the oldstable distribution (stretch), these problems have been fixed\nin version 2.8.0~cvs20161113-1+deb9u2.\n\n\nWe recommend that you upgrade your faad2 packages.\n\n\nFor the detailed security status of faad2 please refer to\nits security tracker page at:\n[\\\nhttps://security-tracker.debian.org/tracker/faad2](https://security-tracker.debian.org/tracker/faad2)\n\n\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-09-15T00:00:00", "type": "osv", "title": "faad2 - security update", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-20194", "CVE-2018-20196", "CVE-2018-19504", "CVE-2019-15296", "CVE-2018-20195", "CVE-2018-20357", "CVE-2018-19502", "CVE-2018-20361", "CVE-2018-20197", "CVE-2018-20359", "CVE-2018-19503", "CVE-2018-20198", "CVE-2018-20358", "CVE-2018-20362"], "modified": "2022-07-21T05:50:16", "id": "OSV:DSA-4522-1", "href": "https://osv.dev/vulnerability/DSA-4522-1", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2023-06-23T15:17:31", "description": "### Background\n\nFAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder.\n\n### Description\n\nMultiple vulnerabilities have been discovered in FAAD2. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nPlease review the referenced CVE identifiers for details.\n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll FAAD2 users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-libs/faad2-2.9.0\"", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-06-15T00:00:00", "type": "gentoo", "title": "FAAD2: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-19502", "CVE-2018-19503", "CVE-2018-19504", "CVE-2018-20194", "CVE-2018-20195", "CVE-2018-20196", "CVE-2018-20197", "CVE-2018-20198", "CVE-2018-20199", "CVE-2018-20357", "CVE-2018-20358", "CVE-2018-20359", "CVE-2018-20360", "CVE-2018-20361", "CVE-2018-20362", "CVE-2019-15296", "CVE-2019-6956"], "modified": "2020-06-15T00:00:00", "id": "GLSA-202006-17", "href": "https://security.gentoo.org/glsa/202006-17", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}
CVE-2018-20198
