faad2 - Debian Package Tracker

general

source: faad2 (main)
version: 2.10.0-1
maintainer: Debian Multimedia Maintainers (archive) (DMD)
uploaders: Matthew W. S. Bell [DMD] – Fabian Greffrath [DMD] – Reinhard Tartler [DMD]
arch: any
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.8.0~cvs20161113-1+deb9u2
o-o-sec: 2.8.0~cvs20161113-1+deb9u2
oldstable: 2.8.8-3
stable: 2.10.0-1
testing: 2.10.0-1
unstable: 2.10.0-1

versioned links

2.8.0~cvs20161113-1+deb9u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.8.8-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.10.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

faad (1 bugs: 0, 1, 0, 0)
libfaad-dev
libfaad2

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In debian/watch no matching files for watch line
  https://github.com/knik0/faad2/releases /knik0/faad2/archive/(\d[_\d]*)(?i)(?:\.(?:tar\.xz|tar\.bz2|tar\.gz|zip|tgz|tbz|txz))

Created: 2021-03-22 Last update: 2021-09-27 06:35

10 security issues in stretch high

There are 10 open security issues in stretch.

6 important issues:

CVE-2021-32272: An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code Execution.
CVE-2021-32273: An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the function ftypin located in mp4read.c. It allows an attacker to cause Code Execution.
CVE-2021-32274: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVE-2021-32276: An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
CVE-2021-32277: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVE-2021-32278: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function lt_prediction located in lt_predict.c. It allows an attacker to cause code Execution.

4 issues postponed or untriaged:

CVE-2018-20196: (needs triaging) There is a stack-based buffer overflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the S_M array is mishandled.
CVE-2018-20199: (needs triaging) A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
CVE-2018-20360: (needs triaging) An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2019-6956: (needs triaging) An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c.

Created: 2021-09-21 Last update: 2021-09-23 06:00

10 security issues in buster high

There are 10 open security issues in buster.

6 important issues:

CVE-2021-32272: An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code Execution.
CVE-2021-32273: An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the function ftypin located in mp4read.c. It allows an attacker to cause Code Execution.
CVE-2021-32274: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVE-2021-32276: An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
CVE-2021-32277: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVE-2021-32278: An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function lt_prediction located in lt_predict.c. It allows an attacker to cause code Execution.

4 issues left for the package maintainer to handle:

CVE-2018-20196: (needs triaging) There is a stack-based buffer overflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the S_M array is mishandled.
CVE-2018-20199: (needs triaging) A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
CVE-2018-20360: (needs triaging) An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2019-6956: (needs triaging) An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-02-19 Last update: 2021-09-23 06:00

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2021-08-14 Last update: 2021-09-27 09:32

3 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 65509b505d70fd13bf57532f68f1087fcbe3bb92
Merge: 59eecd5 9f24bd1
Author: Sebastian Ramacher <sramacher@debian.org>
Date:   Thu Sep 23 21:30:03 2021 +0000

    Merge branch 'lintian-fixes' into 'master'
    
    Fix some issues reported by lintian
    
    See merge request multimedia-team/faad2!1

commit 9f24bd17d6f3c547a1820b0f705157b6980d6806
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Sep 10 17:08:39 2021 +0000

    Update standards version to 4.5.1, no changes needed.
    
    Changes-By: lintian-brush
    Fixes: lintian: out-of-date-standards-version
    See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

commit e4419374db5c66e114b5bf58ec014d68cf6821ad
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Sep 10 17:08:35 2021 +0000

    Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, Repository-Browse.
    
    Changes-By: lintian-brush
    Fixes: lintian: upstream-metadata-file-is-missing
    See-also: https://lintian.debian.org/tags/upstream-metadata-file-is-missing.html
    Fixes: lintian: upstream-metadata-missing-bug-tracking
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-bug-tracking.html
    Fixes: lintian: upstream-metadata-missing-repository
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-repository.html

Created: 2021-09-23 Last update: 2021-09-23 23:41

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2021-01-27 Last update: 2021-01-27 03:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.0 instead of 4.5.0).

Created: 2020-11-17 Last update: 2021-08-18 14:02

news

[rss feed]

[2020-10-26] faad2 2.10.0-1 MIGRATED to testing (Debian testing watch)
[2020-10-20] Accepted faad2 2.10.0-1 (source) into unstable (Fabian Greffrath)
[2020-05-10] faad2 2.9.2-1 MIGRATED to testing (Debian testing watch)
[2020-05-04] Accepted faad2 2.9.2-1 (source) into unstable (Fabian Greffrath)
[2019-11-10] faad2 2.9.1-1 MIGRATED to testing (Debian testing watch)
[2019-11-04] Accepted faad2 2.9.1-1 (source) into unstable (Fabian Greffrath)
[2019-09-17] Accepted faad2 2.8.0~cvs20161113-1+deb9u2 (source amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Hugo Lefeuvre)
[2019-09-17] faad2 2.9.0-1 MIGRATED to testing (Debian testing watch)
[2019-09-15] Accepted faad2 2.8.0~cvs20161113-1+deb9u2 (source amd64) into oldstable->embargoed, oldstable (Hugo Lefeuvre)
[2019-09-11] Accepted faad2 2.9.0-1 (source) into unstable (Fabian Greffrath)
[2019-09-03] faad2 2.8.8-3.2 MIGRATED to testing (Debian testing watch)
[2019-08-31] Accepted faad2 2.8.8-3.2 (source) into unstable (Hugo Lefeuvre)
[2019-08-28] Accepted faad2 2.7-8+deb8u3 (source amd64) into oldoldstable (Hugo Lefeuvre)
[2019-08-28] Accepted faad2 2.8.8-3.1 (source) into unstable (Hugo Lefeuvre)
[2019-06-10] faad2 2.8.8-3 MIGRATED to testing (Debian testing watch)
[2019-06-07] Accepted faad2 2.8.8-3 (source) into unstable (Sebastian Ramacher)
[2019-05-19] Accepted faad2 2.7-8+deb8u2 (source amd64) into oldstable (Hugo Lefeuvre)
[2019-04-22] faad2 2.8.8-2 MIGRATED to testing (Debian testing watch)
[2019-04-17] Accepted faad2 2.8.8-2 (source amd64) into unstable (Fabian Greffrath)
[2018-05-07] Accepted faad2 2.7-8+deb8u1 (source amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Markus Koschany)
[2018-05-07] Accepted faad2 2.8.0~cvs20161113-1+deb9u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Markus Koschany)
[2017-12-24] faad2 2.8.8-1 MIGRATED to testing (Debian testing watch)
[2017-12-18] Accepted faad2 2.8.8-1 (source amd64) into unstable (Fabian Greffrath)
[2017-11-12] faad2 2.8.6-1 MIGRATED to testing (Debian testing watch)
[2017-11-06] Accepted faad2 2.8.6-1 (source amd64) into unstable (Fabian Greffrath)
[2017-10-05] faad2 2.8.5-1 MIGRATED to testing (Debian testing watch)
[2017-09-30] Accepted faad2 2.8.5-1 (source amd64) into unstable (Fabian Greffrath)
[2017-08-30] Accepted faad2 2.7-8+deb7u1 (source amd64) into oldoldstable (Markus Koschany)
[2017-08-08] faad2 2.8.1-2 MIGRATED to testing (Debian testing watch)
[2017-08-02] Accepted faad2 2.8.1-2 (source amd64) into unstable (Fabian Greffrath)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 1

links

homepage
lintian (0, 1)
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.10.0-1
8 bugs