CVE-2019-15296

An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faadresetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffersize - words4, cast to uint32. If ld->buffer_size - words4 is negative, a buffer overflow is later performed via getdwordn(&ld->start[words], ld->bytesleft).

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "debian:debian_linux"
        }
    ]
}

References

Affected packages

Git / github.com/knik0/faad2

Affected ranges

Type

GIT

Repo

https://github.com/knik0/faad2

Events

Introduced

334e7647a5f31903aca33dde39bb8683e9d8cccd

Last affected

334e7647a5f31903aca33dde39bb8683e9d8cccd

Fixed

942c3e0aee748ea6fe97cb2c1aa5893225316174

Database specific

{
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.8.8"
        },
        {
            "last_affected": "2.8.8"
        }
    ],
    "cpe": "cpe:2.3:a:audiocoding:freeware_advanced_audio_decoder_2:2.8.8:*:*:*:*:*:*:*"
}

Affected versions

2.*

2.8.8

Other

2_8_8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15296.json"

vanir_signatures_modified

"2026-07-08T16:07:50Z"

vanir_signatures

[
    {
        "target": {
            "file": "libfaad/bits.c",
            "function": "faad_resetbits"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2019-15296-4aefd7e4",
        "signature_version": "v1",
        "source": "https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174",
        "digest": {
            "function_hash": "124005640876210091824677984462777690187",
            "length": 745.0
        }
    },
    {
        "target": {
            "file": "libfaad/syntax.c",
            "function": "excluded_channels"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2019-15296-5875c100",
        "signature_version": "v1",
        "source": "https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174",
        "digest": {
            "function_hash": "165736104238157740616725237501300890403",
            "length": 622.0
        }
    },
    {
        "target": {
            "file": "libfaad/syntax.c"
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2019-15296-d7b852b1",
        "signature_version": "v1",
        "source": "https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174",
        "digest": {
            "line_hashes": [
                "239380615314083555352035408016690435173",
                "147704977208189036895939348227306827051",
                "329365327040791695350858963688367662444",
                "216007562013221147565173244163313314080"
            ],
            "threshold": 0.9
        }
    },
    {
        "target": {
            "file": "libfaad/bits.c"
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2019-15296-fdd5e5d9",
        "signature_version": "v1",
        "source": "https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174",
        "digest": {
            "line_hashes": [
                "296485932489754999999010566109813086322",
                "251849693720230703288183735121492209136",
                "36364199145169944277639805905228073757",
                "82595847432278138315702463307550916764"
            ],
            "threshold": 0.9
        }
    }
]