PT-2022-5395 · Exiv2+1 · Exiv2+1

Published 2022-10-09 · Updated 2022-11-21 · CVE-2022-3755

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 (affected versions not specified)

Description The issue is related to the QuickTimeVideo::userDataDecoder function in the quicktimevideo.cpp file of the Exiv2 library, which is used for managing image metadata. It is associated with null pointer dereference errors. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2022-06709

CVE-2022-3755

OESA-2022-2101

Affected Products

Exiv2

Red Os

References · 14

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52382 · Exploit
• https://osv.dev/vulnerability/OESA-2022-2101 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3755 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3755 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3755 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3755 · Security Note
• https://bdu.fstec.ru/vul/2022-06709 · Security Note
• https://github.com/Exiv2/exiv2/commit/6bb956ad808590ce2321b9ddf6772974da27c4ca · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2101 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://vuldb.com/?id.212495 · Note
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-exiv2-cve-2022-3717-cve-2022-3718-cve-2022-3719-cve-2022-3755-cve-2022-37 · Note
• https://t.me/cibsecurity/52268 · Telegram Post