CVE-2022-1441

Katalog CVE

CVSS 7.8 · High EPSS 0,98%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada gpac, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.

Rincian

Terbit di NVD

25 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gpac/gpac/commit/3dbe11b37d65c8472faf0654410068e5500b3adb patch · advisory pihak ketiga
• https://github.com/gpac/gpac/issues/2175 exploit · issue tracking · advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5411 advisory pihak ketiga