Lucene search

GoogleOSV:CVE-2022-3664

HistoryOct 26, 2022 - 7:15 p.m.

CVE-2022-3664

2022-10-2619:15:21

Google

osv.dev

axiomatic bento4

buffer overflow

remote attack

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.8%

JSON

A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212004.

CPENameOperatorVersion
bento4eq1.5.0-617
bento4eq1.5.1-621
bento4eq1.4.2-586
bento4eq1.4.2-588
bento4eq1.4.2-587
bento4eq1.4.3-597
bento4eq1.4.3-602
bento4eq1.6.0-638
bento4eq1.5.0-619
bento4eq1.5.1-628

Name	Operator	Version
bento4	eq	1.5.0-617
bento4	eq	1.5.1-621
bento4	eq	1.4.2-586
bento4	eq	1.4.2-588
bento4	eq	1.4.2-587
bento4	eq	1.4.3-597
bento4	eq	1.4.3-602
bento4	eq	1.6.0-638
bento4	eq	1.5.0-619
bento4	eq	1.5.1-628

Rows per page:

1-10 of 501

References

github.com/axiomatic-systems/Bento4/files/9746288/avcinfo_poc1.zip

github.com/axiomatic-systems/Bento4/issues/794

vuldb.com/?id.212004

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.8%

JSON

Related for OSV:CVE-2022-3664