PT-2023-11816 · Mediaarea+3 · Mediaarea Zenlib+3

Published 2023-01-07 · Updated 2024-11-14 · CVE-2020-36646

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MediaArea ZenLib versions up to 0.4.38

Description A problematic vulnerability has been found in MediaArea ZenLib. This issue affects the function Ztring::Date From Seconds 1970 Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to an unchecked return value to null pointer dereference.

Recommendations For MediaArea ZenLib versions up to 0.4.38, upgrade to version 0.4.39 to address this issue. As a temporary workaround, consider restricting the manipulation of the Value argument in the Ztring::Date From Seconds 1970 Local function until the upgrade is applied.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-690

CWE-476

Related Identifiers

ALT-PU-2024-15493

CVE-2020-36646

DLA-3290-1

MGASA-2023-0046

USN-6048-1

Affected Products

Alt Linux

Linuxmint

Mediaarea Zenlib

Ubuntu

References · 23

• https://github.com/MediaArea/ZenLib/releases/tag/v0.4.39 · Patch
• https://github.com/MediaArea/ZenLib/commit/6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408 · Patch
• https://github.com/MediaArea/ZenLib/pull/119 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-36646 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6048-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36646 · Security Note
• https://advisories.mageia.org/MGASA-2023-0046.html · Security Note
• https://osv.dev/vulnerability/DLA-3290-1 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3290 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36646 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0046 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36646 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36646 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36646 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6048-1 · Vendor Advisory