PT-2018-13961 · Videolan · Libmp4V2

Ace Team + 1 · Published 2018-09-20 · Updated 2023-04-11 · CVE-2018-17236

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libmp4v2 version 2.1.0

Description The issue arises from the function MP4Free() in mp4property.cpp, which internally calls free() on an invalid pointer. This results in a SIGABRT signal being raised.

Recommendations For libmp4v2 version 2.1.0, consider disabling the MP4Free() function as a temporary workaround until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2018-17236

Affected Products

Libmp4V2

References · 7

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1629453 · Exploit
• https://cve.org/CVERecord?id=CVE-2018-17236 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17236 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17236 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17236 · Security Note
• https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0 · Note