Headline
Ubuntu Security Notice USN-6313-1
Ubuntu Security Notice 6313-1 - It was discovered that FAAD2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. It was discovered that FAAD2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.
==========================================================================Ubuntu Security Notice USN-6313-1August 29, 2023faad2 vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 20.04 LTS- Ubuntu 18.04 LTS (Available with Ubuntu Pro)- Ubuntu 16.04 LTS (Available with Ubuntu Pro)- Ubuntu 14.04 LTS (Available with Ubuntu Pro)Summary:Several security issues were fixed in FAAD2.Software Description:- faad2: Freeware Advanced Audio (AAC) DecoderDetails:It was discovered that FAAD2 incorrectly handled certain inputs. If a user oran automated system were tricked into opening a specially crafted input file,a remote attacker could possibly use this issue to execute arbitrary code.(CVE-2021-32272, CVE-2021-32273, CVE-2021-32274, CVE-2021-32277,CVE-2021-32278, CVE-2023-38857, CVE-2023-38858)It was discovered that FAAD2 incorrectly handled certain inputs. If a user oran automated system were tricked into opening a specially crafted input file,a remote attacker could possibly use this issue to cause a denial of service.(CVE-2021-32276)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 20.04 LTS: faad 2.9.1-1ubuntu0.1 libfaad-dev 2.9.1-1ubuntu0.1 libfaad2 2.9.1-1ubuntu0.1Ubuntu 18.04 LTS (Available with Ubuntu Pro): faad 2.8.8-1ubuntu0.1~esm1 libfaad-dev 2.8.8-1ubuntu0.1~esm1 libfaad2 2.8.8-1ubuntu0.1~esm1Ubuntu 16.04 LTS (Available with Ubuntu Pro): faad 2.8.0~cvs20150510-1ubuntu0.1+esm1 libfaad-dev 2.8.0~cvs20150510-1ubuntu0.1+esm1 libfaad2 2.8.0~cvs20150510-1ubuntu0.1+esm1Ubuntu 14.04 LTS (Available with Ubuntu Pro): faad 2.7-8+deb8u3ubuntu0.1~esm1 libfaad-dev 2.7-8+deb8u3ubuntu0.1~esm1 libfaad2 2.7-8+deb8u3ubuntu0.1~esm1In general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-6313-1 CVE-2021-32272, CVE-2021-32273, CVE-2021-32274, CVE-2021-32276, CVE-2021-32277, CVE-2021-32278, CVE-2023-38857, CVE-2023-38858Package Information: https://launchpad.net/ubuntu/+source/faad2/2.9.1-1ubuntu0.1Related news
Gentoo Linux Security Advisory 202401-13 - Multiple denial of service vulnerabilities have been found in FAAD2. Versions greater than or equal to 2.11.0 are affected.
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4read.c.
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.