PT-2018-18041 · Mp4V2 · Mp4V2

Published 2018-02-23 · Updated 2018-03-18 · CVE-2018-7339

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MP4v2 versions prior to 2.0.0

Description The issue concerns the MP4Atom class in mp4atom.cpp, which fails to properly validate the Entry Number for the MP4 Table Property. This can be exploited by remote attackers using a crafted mp4 file, potentially leading to a denial of service due to an overflow, insufficient memory allocation, and a segmentation fault, or possibly other unspecified impacts.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-7339

Affected Products

Mp4V2

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-7339 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7339 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-7339 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7339 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7339 · Vendor Advisory
• https://github.com/pingsuewim/libmp4_bof · Note