Lucene search

GoogleOSV:CVE-2022-3785

HistoryOct 31, 2022 - 9:15 p.m.

CVE-2022-3785

2022-10-3121:15:12

Google

osv.dev

axiomatic bento4

critical vulnerability

ap4_databuffer::setdatasize

heap-based buffer overflow

remote attack

exploit disclosed

vdb-212564

software

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

0.001

Percentile

39.7%

JSON

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_DataBuffer::SetDataSize of the component Avcinfo. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212564.

References

github.com/axiomatic-systems/Bento4/files/9658653/POC_avcinfo_15644345.zip

github.com/axiomatic-systems/Bento4/issues/780

vuldb.com/?id.212564

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

0.001

Percentile

39.7%

JSON

Related for OSV:CVE-2022-3785