Summary
It was discovered that fdkaac did not correctly handle certain input. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service. (CVE-2022-36148)
It was discovered that fdkaac did not correctly handle certain memory
operations. If a user or automated system were tricked into opening a
specially crafted file, an attacker could possibly use this issue to cause
a denial of service. (CVE-2022-37781, CVE-2023-34823, CVE-2023-34824)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | fdkaac | 0.6.2-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | fdkaac | 0.6.3-1ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | fdkaac | 0.6.3-1ubuntu0.20.04.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | fdkaac | 1.0.0-1ubuntu0.22.04.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | fdkaac | 1.0.0-1ubuntu0.24.04.1~esm1 |
Vulnerabilities 4
-
Medium 5.5
fdkaac before 1.0.5 was discovered to contain a stack overflow in read_callback function in src/main.c.
-
Medium 5.5
fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf_info function in caf_reader.c.
-
Unscored —
fdkaac commit 53fe239 was discovered to contain a floating point exception (FPE) via wav_open at /src/wav_reader.c.
-
Unscored —
fdkaac v1.0.3 was discovered to contain a heap buffer overflow via __interceptor_memcpy.part.46 at /sanitizer_common/sa…