Lucene search

GoogleOSV:CVE-2022-3666

HistoryOct 26, 2022 - 7:15 p.m.

CVE-2022-3666

2022-10-2619:15:23

Google

osv.dev

axiomatic bento4

critical

use after free

vulnerability

remote attack

public disclosure

vdb-212006

mp42ts

ap4_linearreader::advance

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.8%

JSON

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the file Ap4LinearReader.cpp of the component mp42ts. The manipulation leads to use after free. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212006 is the identifier assigned to this vulnerability.

CPENameOperatorVersion
bento4eq1.5.0-617
bento4eq1.5.1-621
bento4eq1.4.2-586
bento4eq1.4.2-588
bento4eq1.4.2-587
bento4eq1.4.3-597
bento4eq1.4.3-602
bento4eq1.6.0-638
bento4eq1.5.0-619
bento4eq1.5.1-628

Name	Operator	Version
bento4	eq	1.5.0-617
bento4	eq	1.5.1-621
bento4	eq	1.4.2-586
bento4	eq	1.4.2-588
bento4	eq	1.4.2-587
bento4	eq	1.4.3-597
bento4	eq	1.4.3-602
bento4	eq	1.6.0-638
bento4	eq	1.5.0-619
bento4	eq	1.5.1-628

Rows per page:

1-10 of 501

References

github.com/axiomatic-systems/Bento4/files/9744391/mp42ts_poc.zip

github.com/axiomatic-systems/Bento4/issues/793

vuldb.com/?id.212006

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.8%

JSON

Related for OSV:CVE-2022-3666