CVE-2022-3662

A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
References
Link Resource
https://github.com/axiomatic-systems/Bento4/files/9817606/mp42hls_cuaf_Ap4Sample99.zip Exploit Third Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/802 Exploit Third Party Advisory
https://vuldb.com/?id.212002 Permissions Required Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:axiosys:bento4:1.6.0-639:*:*:*:*:*:*:*

History

28 Oct 2022, 17:29

Type Values Removed Values Added
CWE CWE-119
CPE cpe:2.3:a:axiosys:bento4:1.6.0-639:*:*:*:*:*:*:*
References (MISC) https://github.com/axiomatic-systems/Bento4/files/9817606/mp42hls_cuaf_Ap4Sample99.zip - (MISC) https://github.com/axiomatic-systems/Bento4/files/9817606/mp42hls_cuaf_Ap4Sample99.zip - Exploit, Third Party Advisory
References (MISC) https://github.com/axiomatic-systems/Bento4/issues/802 - (MISC) https://github.com/axiomatic-systems/Bento4/issues/802 - Exploit, Third Party Advisory
References (MISC) https://vuldb.com/?id.212002 - (MISC) https://vuldb.com/?id.212002 - Permissions Required, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.8

26 Oct 2022, 19:38

Type Values Removed Values Added
New CVE

Information

Published : 2022-10-26 19:15

Updated : 2024-02-04 22:51


NVD link : CVE-2022-3662

Mitre link : CVE-2022-3662

CVE.ORG link : CVE-2022-3662


JSON object : View

Products Affected

axiosys

  • bento4
CWE
CWE-416

Use After Free

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer