CVE-2022-3662: Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free

Published Oct 26, 2022

Updated

A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.

Affected Software

1 affected component

Axiosys Bento4=1.6.0-639

Event History

Oct 26, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-3662?

The severity of CVE-2022-3662 is high.

How does CVE-2022-3662 affect Axiomatic Bento4?

CVE-2022-3662 affects Axiomatic Bento4 by leading to use after free in the GetOffset function of the mp42hls component.

Can CVE-2022-3662 be exploited remotely?

Yes, the attack for CVE-2022-3662 can be initiated remotely.

Is there a fix available for CVE-2022-3662?

It is recommended to update to a fixed version of Axiomatic Bento4.

What is the CWE classification for CVE-2022-3662?

CVE-2022-3662 is classified under CWE-416 (Use After Free) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).