Advisories ยป MGASA-2020-0062

Updated libmp4v2 packages fix security vulnerabilities

Publication date: 28 Jan 2020
Modification date: 28 Jan 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2018-14325 , CVE-2018-14326 , CVE-2018-14379 , CVE-2018-14403 , CVE-2018-14446

Description

Updated libmp4v2 packages fix security vulnerabilities:

The libmp4v2 library through version 2.1.0 is vulnerable to an integer
underflow when parsing an MP4Atom in mp4atom.cpp. An attacker could exploit
this to cause a denial of service via crafted MP4 file (CVE-2018-14325).

The libmp4v2 library through version 2.1.0 is vulnerable to an integer
overflow and resultant heap-based buffer overflow when resizing an MP4Array
for the ftyp atom in mp4array.h. An attacker could exploit this to cause a
denial of service via crafted MP4 file (CVE-2018-14326).

MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the
MP4ItemAtom data type in a certain case where MP4DataAtom is required, which
allows remote attackers to cause a denial of service (memory corruption) or
possibly have unspecified other impact via a crafted MP4 file, because access
to the data structure has different expectations about layout as a result of
this type confusion (CVE-2018-14379).

MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of
atom names, leading to use of an inappropriate data type for associated atoms.
The resulting type confusion can cause out-of-bounds memory access
(CVE-2018-14403).

MP4Integer32Property::Read in atom_avcC.cpp in MP4v2 2.1.0 allows remote
attackers to cause a denial of service (heap-based buffer overflow and
application crash) or possibly have unspecified other impact via a crafted
MP4 file (CVE-2018-14446).

References

SRPMS

7/core