PT-2023-16993 · Mp4V2 · Mp4V2

Ccpx · Publicado 2023-03-17 · Atualizado 2024-05-17 · CVE-2023-1451

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions MP4v2 version 2.1.2

Description A vulnerability was found in the function mp4v2::impl::MP4Track::GetSampleFileOffset of the file mp4track.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Recommendations For MP4v2 version 2.1.2, consider disabling the mp4v2::impl::MP4Track::GetSampleFileOffset function until a patch is available. Restrict access to the mp4track.cpp file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Enumeração de Fraquezas

CWE-404

Identificadores relacionados

CVE-2023-1451

Produtos afetados

Mp4V2

Referências · 11

• 🔥 https://github.com/RichTrouble/mp4v2_mp4track_poc/blob/main/id_000000%2Csig_08%2Csrc_001076%2Ctime_147809374%2Cexecs_155756872%2Cop_havoc%2Crep_8 · Exploit
• 🔥 https://github.com/RichTrouble/mp4v2_mp4track_poc · Exploit
• https://ubuntu.com/security/CVE-2023-1451 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1451 · Nota de Segurança
• https://vuldb.com/?id.223296 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1451 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-1451 · Nota de Segurança
• https://t.me/cvenotify/46368 · Publicação no Telegram
• https://vuldb.com/?ctiid.223296 · Nota
• https://t.me/cibsecurity/60237 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1451 · Aviso do Fabricante