Description
MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated atoms. The resulting type confusion can cause out-of-bounds memory access.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | mp4v2 | No fix yet | — |
| Ubuntu 16.04 LTS | mp4v2 | No fix yet | — |
References
- http://www.openwall.com/lists/oss-security/2018/07/18/3
- FEDORA-2019-d53d4a79ac vendor-advisory
- FEDORA-2019-1030f4816a vendor-advisory
- FEDORA-2019-6469ad8129 vendor-advisory
- https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0