PT-2022-19234 · Unknown · Aviextractor

Rahul D Kankrale · Published 2022-05-03 · Updated 2022-05-11 · CVE-2022-28786

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions aviextractor library versions prior to SMR May-2022 Release 1

Description The issue is caused by improper buffer size check logic in the aviextractor library, allowing out of bounds read and potentially leading to temporary denial of service. The patch for this issue adds buffer size check logic to prevent such occurrences.

Recommendations For versions prior to SMR May-2022 Release 1, update to SMR May-2022 Release 1 or later to resolve the issue. As a temporary workaround, consider implementing additional buffer size checks to prevent out of bounds reads until the patch can be applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-28786

Affected Products

Aviextractor

References · 5

• https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28786 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28786 · Vendor Advisory
• https://t.me/cibsecurity/41872 · Telegram Post
• https://t.me/cvenotify/29668 · Telegram Post