PT-2023-22324 · Mp4V2 · Mp4V2

Z1R00 · Publicado 2023-04-14 · Atualizado 2023-04-19 · CVE-2023-29584

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mp4v2 version 2.0.0

Description The issue is a heap buffer overflow that occurs via the MP4GetVideoProfileLevel function at /src/mp4.cpp. This function is part of the mp4v2 library, which is used for handling MP4 files. The heap buffer overflow can potentially lead to arbitrary code execution or crashes.

Recommendations For mp4v2 version 2.0.0, consider disabling the MP4GetVideoProfileLevel function until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2023-29584

Produtos afetados

Mp4V2

Referências · 9

• 🔥 https://github.com/enzo1982/mp4v2/issues/30 · Exploit
• 🔥 https://github.com/z1r00/fuzz_vuln/blob/main/mp4v2/heap-buffer-overflow/MP4GetVideoProfileLevel/readme.md · Exploit
• https://ubuntu.com/security/CVE-2023-29584 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-29584 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29584 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-29584 · Nota de Segurança
• https://t.me/cvenotify/48233 · Publicação no Telegram
• https://t.me/cibsecurity/62133 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-29584 · Aviso do Fabricante