CVE-2018-19502

CVE-2018-19502 affects FAAD2 2.8.1: heap-based overflow in excluded_channels() (libfaad/syntax.c). Exploitation could enable denial of service via crafted MPEG AAC data. Advisory remediation: upgrade FAAD2 to at least 2.9.0 (per GLSA 202006-17) or equivalent Debian/DSA-4522/DLA-1899 guidance; Deb...

CVE-2018-20196

CVE-2018-20196 affects FAAD2 (Freeware Advanced Audio Decoder) 2.8.8, with a stack-based buffer overflow in the third instance of calculate_gain (libfaad/sbr_hfadj.c) caused by mishandling the S_M array. The vulnerability could lead to denial of service or other unspecified impact. Public advisor...

CVE-2019-6956

FAAD2 2.8.8 contains CVE-2019-6956: a buffer over-read in ps_mix_phase (libfaad/ps_dec.c). Public advisories (Debian, Gentoo GLSA) link this to potential denial of service and related impacts; Debian notes several FAAD2 CVEs in older releases. The issues are fixed in later FAAD2 releases (Gentoo ...

CVE-2018-20197

CVE-2018-20197 refers to a stack-based buffer underflow in FAAD2 (Freeware Advanced Audio Decoder) 2.8.8, in the third instance of calculate_gain within libfaad/sbr_hfadj.c. A crafted input may cause denial of service or unspecified impact due to mishandling of the G_max > G case. Connected so...

CVE-2018-20194

CVE-2018-20194 affects FAAD2 (FAAD2 2.8.8) via a stack-based buffer underflow in the third instance of calculate_gain() in libfaad/sbr_hfadj.c. A crafted input can cause denial of service or other unspecified impact by mishandling G_max

CVE-2019-15296

FAAD2 vulnerability CVE-2019-15296 affects Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c can read a negative remaining buffer size (ld->buffer_size - words*4), leading to a buffer overflow via getdword_n, with the impact described as potential d...

CVE-2018-19504

CVE-2018-19504 affects FAAD2 2.8.1, with a NULL pointer dereference in ifilter_bank() (libfaad/filtbank.c). Supported documents consistently describe this vulnerability across multiple feeds (NVD, CNVD, Debian DSAs, Gentoo GLSA) and indicate exposure in FAAD2; no exploit details are provided in t...

CVE-2018-19503

CVE-2018-19503 affects FAAD2 2.8.1: a stack-based buffer overflow in libfaad/sbr_hfadj.c (calculate_gain) could enable denial of service or code execution. Several sources corroborate FAAD2 vulnerabilities; Debian GLSA/DSA recommendations urge upgrading to newer FAAD2 (e.g., 2.9.0+). If upgrading...

CVE-2017-9254

CVE-2017-9254 is confirmed in FAAD2 version 2.7, where the function mp4ff_read_stts in common/mp4ff/mp4atom.c can be exploited by a crafted MP4 file to cause a denial of service (large loop and high CPU usage). The connected documents (OSV/ CNVD/NVD references) provide identical descriptions of t...

CVE-2017-9253

CVE-2017-9253 affects Freeware Advanced Audio Decoder 2 (FAAD2) 2.7. The vulnerability is in the mp4ff_read_stsd function (common/mp4ff/mp4atom.c) and can be exploited remotely to cause a denial of service via a crafted MP4 file (large loop/CPU consumption). Debian and OSV entries corroborate the...

CVE-2017-9257

Summary (CVE-2017-9257): The vulnerability affects FAAD2 2.7, where the function mp4ff_read_ctts in common/mp4ff/mp4atom.c can be abused by a crafted MP4 file to trigger a denial of service through a large loop/CPU consumption. The issue is documented across multiple feeds; Debian’s DLA-1077-1 no...

CVE-2017-9255

The vulnerability CVE-2017-9255 affects Freeware Advanced Audio Decoder 2 (FAAD2) version 2.7. The mp4ff_read_stsc function in common/mp4ff/mp4atom.c is vulnerable to crafted MP4 files, allowing remote attackers to trigger a denial of service via a large loop and high CPU usage. The connected OSV...

CVE-2017-9222

Affected software: Freeware Advanced Audio Decoder 2 (FAAD2) version 2.7. The vulnerability is in the mp4ff_parse_tag function (common/mp4ff/mp4meta.c) and can be triggered by a crafted MP4 file. Root cause: parsing a crafted file can cause an infinite loop, leading to CPU consumption and denial ...

CVE-2017-9256

CVE-2017-9256 affects FAAD2 2.7, where the mp4ff_read_stco function in common/mp4ff/mp4atom.c can be triggered by a crafted MP4 file to cause a denial of service (large loop and high CPU usage). Public references confirm the issue in FAAD2 2.7 and map to multiple CVE entries. Debian’s DLA-1077-1 ...