CVE-2022-3785 - Axiomatic Bento4 Avcinfo SetDataSize heap-based overflow

Back Back to CVE browser

HIGH

Axiomatic Bento4 Avcinfo SetDataSize heap-based overflow

Published Oct 31, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.69%

Description

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_DataBuffer::SetDataSize of the component Avcinfo. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212564.

Affected products

Vendor Axiomatic Product Bento4 Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Axiomatic

Bento4

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-787

Out-of-bounds Write

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43133
Advisory
https://github.com/axiomatic-systems/Bento4/files/9658653/POC_avcinfo_15644345.zip
ExploitThird Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/780
ExploitThird Party Advisory
https://vuldb.com/?id.212564
Permissions RequiredThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43133		Advisory
https://github.com/axiomatic-systems/Bento4/files/9658653/POC_avcinfo_15644345.zip		ExploitThird Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/780		ExploitThird Party Advisory
https://vuldb.com/?id.212564		Permissions RequiredThird Party Advisory