Test Kennung:	1.3.6.1.4.1.25623.1.1.10.2020.0062
Kategorie:	Mageia Linux Local Security Checks
Titel:	Mageia: Security Advisory (MGASA-2020-0062)
Zusammenfassung:	The remote host is missing an update for the 'libmp4v2' package(s) announced via the MGASA-2020-0062 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'libmp4v2' package(s) announced via the MGASA-2020-0062 advisory. Vulnerability Insight: Updated libmp4v2 packages fix security vulnerabilities: The libmp4v2 library through version 2.1.0 is vulnerable to an integer underflow when parsing an MP4Atom in mp4atom.cpp. An attacker could exploit this to cause a denial of service via crafted MP4 file (CVE-2018-14325). The libmp4v2 library through version 2.1.0 is vulnerable to an integer overflow and resultant heap-based buffer overflow when resizing an MP4Array for the ftyp atom in mp4array.h. An attacker could exploit this to cause a denial of service via crafted MP4 file (CVE-2018-14326). MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted MP4 file, because access to the data structure has different expectations about layout as a result of this type confusion (CVE-2018-14379). MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated atoms. The resulting type confusion can cause out-of-bounds memory access (CVE-2018-14403). MP4Integer32Property::Read in atom_avcC.cpp in MP4v2 2.1.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted MP4 file (CVE-2018-14446). Affected Software/OS: 'libmp4v2' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2018-14325 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRSO2IMK6P7MOIZWGWKONPIEHKBA7WL3/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISUIWPKBWPXORUFNWBGFTKQS7UUVUC4/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE/ http://www.openwall.com/lists/oss-security/2018/07/16/1 https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0 Common Vulnerability Exposure (CVE) ID: CVE-2018-14326 Common Vulnerability Exposure (CVE) ID: CVE-2018-14379 http://www.openwall.com/lists/oss-security/2018/07/17/1 Common Vulnerability Exposure (CVE) ID: CVE-2018-14403 http://www.openwall.com/lists/oss-security/2018/07/18/3 Common Vulnerability Exposure (CVE) ID: CVE-2018-14446 http://hac425.unaux.com/index.php/archives/63/ https://github.com/TechSmith/mp4v2/issues/20
Copyright	Copyright (C) 2022 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.