Lucene search

Gentoo FoundationGLSA-202305-01

HistoryMay 03, 2023 - 12:00 a.m.

AtomicParsley: Multiple Vulnerabilities

2023-05-0300:00:00

Gentoo Foundation

security.gentoo.org

atomicparsley

vulnerabilities

update

latest version

gentoo

mpeg4

metadata

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

73.0%

JSON

Background

AtomicParsley is a command line program for manipulating iTunes-style metadata in MPEG4 files.

Description

Multiple vulnerabilities have been discovered in AtomicParsley. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

Users can pass only trusted input to AtomicParsley.

Resolution

Previously, the “wez” AtomicParsley fork was packaged in Gentoo as media-video/atomicparsley-wez. This fork is now packaged as media-video/atomicparsley, so users of the fork’s package should now depclean it:

 # emerge --ask --depclean "media-video/atomicparsley-wez"

All AtomicParsley users should upgrade to the latest version, which is a packaging of the “wez” AtomicParsley fork:

 # emerge --sync
 # emerge --ask --oneshot --verbose "&gt;=media-video/atomicparsley-0.9.6_p20210715_p151551"

OSVersionArchitecturePackageVersionFilename
Gentooanyallmedia-video/atomicparsley< 0.9.6_p20210715_p151551UNKNOWN
Gentooanyallmedia-video/atomicparsley-wez<= 0.9.6UNKNOWN