5.5

CVE-2022-3668

Exploit

Axiomatic Bento4 mp4edit CreateAtomFromStream memory leak

A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream of the component mp4edit. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212008.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Axiosys ≫ Bento4 Version1.6.0-639
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.65% 0.464
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cna@vuldb.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

CWE-404 Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

https://github.com/axiomatic-systems/Bento4/files/9640968/Bug_1_POC.zip
Third Party Advisory
Exploit
https://github.com/axiomatic-systems/Bento4/issues/776
Third Party Advisory
Exploit
https://vuldb.com/?id.212008
Third Party Advisory
Permissions Required