CVE-2022-3965

{"id": "CVE-2022-3965", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-11-13T08:15:15.367", "references": [{"url": "https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/13c13109759090b7f7182480d075e13b36ed8edd", "tags": ["Patch", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://security.gentoo.org/glsa/202312-14", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.213544", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en ffmpeg y clasificada como problem\u00e1tica. Esta vulnerabilidad afecta a la funci\u00f3n smc_encode_stream del archivo libavcodec/smcenc.c del componente QuickTime Graphics Video Encoder. La manipulaci\u00f3n del argumento y_size conduce a una lectura fuera de l\u00edmites. El ataque se puede iniciar de forma remota. El nombre del parche es 13c13109759090b7f7182480d075e13b36ed8edd. Se recomienda aplicar un parche para solucionar este problema. El identificador de esta vulnerabilidad es VDB-213544."}], "lastModified": "2023-12-23T12:15:21.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CE47406-F17E-4C7D-B924-22DEBD106D45", "versionEndExcluding": "5.0.3", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "952B0691-9892-4CDE-A4E7-1EF0EE51B27B", "versionEndExcluding": "5.1.3", "versionStartIncluding": "5.1"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}