MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.
CVE-2024-58397
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-58397
mp4v2
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/enzo1982/mp4v2",
"vendor": "enzo1982",
"product": "mp4v2",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "2.1.3"
}
],
"packageURL": "pkg:github/enzo1982/mp4v2",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2024-58397
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #34386 · Revision 1
- Added to Heist Feed
- Publisher date