CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-14325
https://notcve.org/view.php?id=CVE-2018-14325
In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp. En MP4v2 2.0.0, hay un subdesbordamiento de enteros (con una corrupción de memoria resultante) al analizar MP4Atom en mp4atom.cpp. • http://www.openwall.com/lists/oss-security/2018/07/16/1 https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRSO2IMK6P7MOIZWGWKONPIEHKBA7WL3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GISUIWPKBWPXORUFNWBGFTKQS7UUVUC4 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-14054
https://notcve.org/view.php?id=CVE-2018-14054
A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0. A dangling pointer is freed again in the destructor once an exception is triggered. Existe una doble liberación (double free) en la clase MP4StringProperty en mp4property.cpp en MP4v2 2.0.0. Un puntero pendiente se libera de nuevo en el destructor una vez se desencadena una excepción. • http://www.openwall.com/lists/oss-security/2018/07/13/1 https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRSO2IMK6P7MOIZWGWKONPIEHKBA7WL3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GISUIWPKBWPXORUFNWBGFTKQS7UUVUC4 • CWE-415: Double Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7339
https://notcve.org/view.php?id=CVE-2018-7339
The MP4Atom class in mp4atom.cpp in MP4v2 through 2.0.0 mishandles Entry Number validation for the MP4 Table Property, which allows remote attackers to cause a denial of service (overflow, insufficient memory allocation, and segmentation fault) or possibly have unspecified other impact via a crafted mp4 file. La clase MP4Atom en mp4atom.cpp en MP4v2, hasta la versión 2.0.0, no gestiona la validación Entry Number para MP4 Table Property. Esto permite que atacantes remotos provoquen una denegación de servicio (desbordamiento, asignación de memoria insuficiente y fallo de segmentación) o, posiblemente, otro tipo de impacto sin especificar mediante un archivo MP4 manipulado. • https://github.com/pingsuewim/libmp4_bof • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •