CVE-2022-1441CWE-119

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion

published April 25, 2022

CVSS
—
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00978 · 61.8th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2022-04-25T00:00Z
EPSS history
Timeline
  • 25 APR 00:00Z
    MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion
    cvelistv5