ALT-BU-2024-1462-2
Branch c10f2 update bulletin.
Package php8.3-swoole updated to version 5.1.1-alt2.2 for branch c10f2 in task 338636.
Closed bugs
Ошибка сегментирования в php8.3, при наличии php8.3-swoole и php8.3-mysqlnd
Closed vulnerabilities
BDU:2018-00113
Уязвимость функции mp4ff_read_ctts декодера аудио-файлов Freeware Advanced Audio Decoder 2, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-00419
Уязвимость функции mp4ff_read_stts набора программного обеспечения для работы с аудиофайлами Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-03596
Уязвимость функции excluded_channels() аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
BDU:2019-03597
Уязвимость функции calculate_gain() аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
BDU:2019-03598
Уязвимость функции ifilter_bank() аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
BDU:2019-03599
Уязвимость функции calculate_gain аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
BDU:2019-03600
Уязвимость компонента ic_predict (libfaad/ic_predict.c) аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-03601
Уязвимость функции calculate_gain аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2019-03602
Уязвимость функции ifilter_bank аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-03603
Уязвимость функции sbr_process_channel аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-03604
Уязвимость функции lt_prediction аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-03605
Уязвимость функции sbrDecodeSingleFramePS аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-03606
Уязвимость функции hf_assembly аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-03641
Уязвимость функции faad_resetbits() набора программного обеспечения для работы с аудиофайлами Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
BDU:2019-03650
Уязвимость функции filter_bank libfaad/filtbank.c набора программного обеспечения для работы с аудиофайлами Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04177
Уязвимость функции mp4ff_read_stsd (common/mp4ff/mp4atom.c) аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04178
Уязвимость функции mp4ff_read_stsc (common/mp4ff/mp4atom.c) аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04179
Уязвимость функции mp4ff_read_stco (common/mp4ff/mp4atom.c) аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04180
Уязвимость функции mp4ff_read_mdhd (common/mp4ff/mp4atom.c) аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04181
Уязвимость функции mp4ff_read_stts (common/mp4ff/mp4atom.c) аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04564
Уязвимость функции mp4ff_parse_tag программного обеспечения для работы с аудиофайлами Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04565
Уязвимость функции mp4ff_read_stsd программного обеспечения для работы с аудиофайлами Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04566
Уязвимость функции mp4ff_read_stsc программного обеспечения для работы с аудиофайлами Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04567
Уязвимость функции mp4ff_read_stco программного обеспечения для работы с аудиофайлами Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04568
Уязвимость функции mp4ff_read_stco программного обеспечения для работы с аудиофайлами Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05696
Уязвимость функции ifilter_bank компонента libfaad/filtbank.c аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05764
Уязвимость функции ps_mix_phase компонента libfaad/ps_dec.c аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю получить доступ к конфиденциальным данным, а также вызвать отказ в обслуживании
BDU:2022-05765
Уязвимость функции sbr_process_channel компонента libfaad/sbr_dec.c аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05766
Уязвимость функции calculate_gain компонента libfaad/sbr_hfadj.c аудио декодера Freeware Advanced Audio Decoder 2 (FAAD2), позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2017-9218
The mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9219
The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (memory allocation error and application crash) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9220
The mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (memory allocation error) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9221
The mp4ff_read_mdhd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9222
The mp4ff_parse_tag function in common/mp4ff/mp4meta.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9223
The mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9253
The mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9254
The mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9255
The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9256
The mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2017-9257
The mp4ff_read_ctts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.
Modified: 2024-11-21
CVE-2018-19502
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer overflow in the function excluded_channels() in libfaad/syntax.c.
- https://github.com/TeamSeri0us/pocs/tree/master/faad
- https://github.com/TeamSeri0us/pocs/tree/master/faad
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- https://sourceforge.net/p/faac/bugs/240/
- https://sourceforge.net/p/faac/bugs/240/
- DSA-4522
- DSA-4522
Modified: 2024-11-21
CVE-2018-19503
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer overflow in the function calculate_gain() in libfaad/sbr_hfadj.c.
- https://github.com/TeamSeri0us/pocs/tree/master/faad
- https://github.com/TeamSeri0us/pocs/tree/master/faad
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- https://sourceforge.net/p/faac/bugs/240/
- https://sourceforge.net/p/faac/bugs/240/
- DSA-4522
- DSA-4522
Modified: 2024-11-21
CVE-2018-19504
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer dereference in ifilter_bank() in libfaad/filtbank.c.
- https://github.com/TeamSeri0us/pocs/tree/master/faad
- https://github.com/TeamSeri0us/pocs/tree/master/faad
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- https://sourceforge.net/p/faac/bugs/240/
- https://sourceforge.net/p/faac/bugs/240/
- DSA-4522
- DSA-4522
Modified: 2024-11-21
CVE-2018-20194
There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because limiting the additional noise energy level is mishandled for the G_max <= G case.
- https://github.com/knik0/faad2/issues/21
- https://github.com/knik0/faad2/issues/21
- [debian-lts-announce] 20190519 [SECURITY] [DLA 1791-1] faad2 security update
- [debian-lts-announce] 20190519 [SECURITY] [DLA 1791-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- DSA-4522
- DSA-4522
Modified: 2024-11-21
CVE-2018-20195
A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Modified: 2024-11-21
CVE-2018-20196
There is a stack-based buffer overflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the S_M array is mishandled.
Modified: 2024-11-21
CVE-2018-20197
There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because limiting the additional noise energy level is mishandled for the G_max > G case.
- https://github.com/knik0/faad2/issues/20
- https://github.com/knik0/faad2/issues/20
- [debian-lts-announce] 20190519 [SECURITY] [DLA 1791-1] faad2 security update
- [debian-lts-announce] 20190519 [SECURITY] [DLA 1791-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- DSA-4522
- DSA-4522
Modified: 2024-11-21
CVE-2018-20198
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.
- https://github.com/knik0/faad2/issues/23
- https://github.com/knik0/faad2/issues/23
- [debian-lts-announce] 20190519 [SECURITY] [DLA 1791-1] faad2 security update
- [debian-lts-announce] 20190519 [SECURITY] [DLA 1791-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- DSA-4522
- DSA-4522
Modified: 2024-11-21
CVE-2018-20199
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
- https://github.com/knik0/faad2/issues/24
- https://github.com/knik0/faad2/issues/24
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- [debian-lts-announce] 20211024 [SECURITY] [DLA 2792-1] faad2 security update
- [debian-lts-announce] 20211024 [SECURITY] [DLA 2792-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- DSA-5109
- DSA-5109
Modified: 2024-11-21
CVE-2018-20357
A NULL pointer dereference was discovered in sbr_process_channel of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash.
Modified: 2024-11-21
CVE-2018-20358
An invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Modified: 2024-11-21
CVE-2018-20359
An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Modified: 2024-11-21
CVE-2018-20360
An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
- https://github.com/knik0/faad2/issues/32
- https://github.com/knik0/faad2/issues/32
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- [debian-lts-announce] 20211024 [SECURITY] [DLA 2792-1] faad2 security update
- [debian-lts-announce] 20211024 [SECURITY] [DLA 2792-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- DSA-5109
- DSA-5109
Modified: 2024-11-21
CVE-2018-20361
An invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Modified: 2024-11-21
CVE-2018-20362
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash because adding to windowed output is mishandled in the EIGHT_SHORT_SEQUENCE case.
- https://github.com/knik0/faad2/issues/26
- https://github.com/knik0/faad2/issues/26
- [debian-lts-announce] 20190519 [SECURITY] [DLA 1791-1] faad2 security update
- [debian-lts-announce] 20190519 [SECURITY] [DLA 1791-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- DSA-4522
- DSA-4522
Modified: 2024-11-21
CVE-2019-15296
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow is later performed via getdword_n(&ld->start[words], ld->bytes_left).
- https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174
- https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- 20190916 [SECURITY] [DSA 4522-1] faad2 security update
- GLSA-202006-17
- GLSA-202006-17
- DSA-4522
- DSA-4522
Modified: 2024-11-21
CVE-2019-6956
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c.
- https://github.com/TeamSeri0us/pocs/blob/master/faad/global-buffer-overflow%40ps_mix_phase.md
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
- [debian-lts-announce] 20211024 [SECURITY] [DLA 2792-1] faad2 security update
- GLSA-202006-17
- https://sourceforge.net/p/faac/bugs/240/
- DSA-5109
- https://github.com/TeamSeri0us/pocs/blob/master/faad/global-buffer-overflow%40ps_mix_phase.md
- DSA-5109
- https://sourceforge.net/p/faac/bugs/240/
- GLSA-202006-17
- [debian-lts-announce] 20211024 [SECURITY] [DLA 2792-1] faad2 security update
- [debian-lts-announce] 20190828 [SECURITY] [DLA 1899-1] faad2 security update
Modified: 2024-11-21
CVE-2023-38857
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4read.c.
Modified: 2024-11-21
CVE-2023-38858
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.