Description
A vulnerability was found in MP4v2 2.1.2. It has been classified as problematic. Affected is the function mp4v2::impl::MP4Track::GetSampleFileOffset of the file mp4track.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223296.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MP4v2 | 2.1.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | mp4v2 | No fix yet | — |
| Ubuntu 16.04 LTS | mp4v2 | No fix yet | — |
References
- https://vuldb.com/?id.223296 vdb-entry technical-description
- https://vuldb.com/?ctiid.223296 signature permissions-required
- https://github.com/RichTrouble/mp4v2_mp4track_poc exploit
- https://github.com/RichTrouble/mp4v2_mp4track_poc/blob/main/id_000000%2Csig_08%2Csrc_001076%2Ctime_147809374%2Cexecs_155756872%2Cop_havoc%2Crep_8 exploit