Updated libmp4v2 packages fix security vulnerabilities: The libmp4v2 library through version 2.1.0 is vulnerable to an integer underflow when parsing an MP4Atom in mp4atom.cpp. An attacker could exploit this to cause a denial of service via crafted MP4 file (CVE-2018-14325). . MGASA-2020-0062 - Updated libmp4v2 packages fix security vulnerabilities Publication date: 28 Jan 2020 URL: https://advisories.mageia.org/MGASA-2020-0062.html Type: security Affected Mageia releases: 7 CVE: CVE-2018-14325, CVE-2018-14326, CVE-2018-14379, CVE-2018-14403, CVE-2018-14446 Updated libmp4v2 packages fix security vulnerabilities: The libmp4v2 library through version 2.1.0 is vulnerable to an integer underflow when parsing an MP4Atom in mp4atom.cpp. An attacker could exploit this to cause a denial of service via crafted MP4 file (CVE-2018-14325). The libmp4v2 library through version 2.1.0 is vulnerable to an integer overflow and resultant heap-based buffer overflow when resizing an MP4Array for the ftyp atom in mp4array.h. An attacker could exploit this to cause a denial of service via crafted MP4 file (CVE-2018-14326). MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted MP4 file, because access to the data structure has different expectations about layout as a result of this type confusion (CVE-2018-14379). MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated atoms. The resulting type confusion can cause out-of-bounds memory access (CVE-2018-14403). MP4Integer32Property::Read in atom_avcC.cpp in MP4v2 2.1.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted MP4 file(CVE-2018-14446). References: - https://bugs.mageia.org/show_bug.cgi?id=25962 - https://lists.fedoraproject.org/archives/list/
This release address a potential security issue in libmp4v2 for Mageia 6: CVE-2018-14054: libmp4v2: Double free in the MP4StringProperty class in mp4property.cpp References: . MGASA-2019-0048 - Updated libmp4v2 packages fix security vulnerability Publication date: 23 Jan 2019 URL: https://advisories.mageia.org/MGASA-2019-0048.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-14054 This release address a potential security issue in libmp4v2 for Mageia 6: CVE-2018-14054: libmp4v2: Double free in the MP4StringProperty class in mp4property.cpp References: - https://bugs.mageia.org/show_bug.cgi?id=24175 - https://www.openwall.com/lists/oss-security/2019/01/09/2 - https://www.cve.org/CVERecord?id=CVE-2018-14054 SRPMS: - 6/core/libmp4v2-2.0.0-9.1.mga6 . MGASA-2019-0048 - Updated libmp4v2 packages fix security vulnerability Publication date: 23 Jan 2019. libmp4v2, release, address, potential, security, mageia, cve-2018-14054. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.