Exiv2 QuickTime Video quicktimevideo.cpp decodeBlock null pointer dereference 🚫 [False Positive]

A vulnerability was suspected in Exiv2. This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all. Issue was introduced on the main (dev) branch and fixed shortly afterwards, so none of the official releases were ever affected.

Field11/21/2022 13:1111/25/2022 17:3111/25/2022 17:39
nameExiv2Exiv2Exiv2
componentQuickTime Video HandlerQuickTime Video HandlerQuickTime Video Handler
filequicktimevideo.cppquicktimevideo.cppquicktimevideo.cpp
functionQuickTimeVideo::decodeBlockQuickTimeVideo::decodeBlockQuickTimeVideo::decodeBlock
cwe476 (null pointer dereference)476 (null pointer dereference)476 (null pointer dereference)
risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
urlhttps://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52053https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52053https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52053
namePatchPatchPatch
patch_name459910c36a21369c09b75bcfa82f287c9da56abf459910c36a21369c09b75bcfa82f287c9da56abf459910c36a21369c09b75bcfa82f287c9da56abf
patch_urlhttps://github.com/Exiv2/exiv2/commit/459910c36a21369c09b75bcfa82f287c9da56abfhttps://github.com/Exiv2/exiv2/commit/459910c36a21369c09b75bcfa82f287c9da56abfhttps://github.com/Exiv2/exiv2/commit/459910c36a21369c09b75bcfa82f287c9da56abf
cveCVE-2022-3718CVE-2022-3718CVE-2022-3718
responsibleVulDBVulDBVulDB
date1666821600 (10/27/2022)1666821600 (10/27/2022)1666821600 (10/27/2022)
typeImage Processing SoftwareImage Processing SoftwareImage Processing Software
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_auNNN
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_eNDNDND
cvss3_vuldb_eXXX
cvss2_vuldb_basescore5.05.05.0
cvss2_vuldb_tempscore4.44.44.4
cvss3_vuldb_basescore4.34.34.3
cvss3_vuldb_tempscore4.14.14.1
cvss3_meta_basescore4.34.34.3
cvss3_meta_tempscore4.14.14.1
price_0day
disputed111
falsepositive111
response_summaryIssue was introduced on the main (dev) branch and fixed shortly afterwards, so none of the official releases were ever affected.Issue was introduced on the main (dev) branch and fixed shortly afterwards, so none of the official releases were ever affected.Issue was introduced on the main (dev) branch and fixed shortly afterwards, so none of the official releases were ever affected.
identifier459910c36a21369c09b75bcfa82f287c9da56abf459910c36a21369c09b75bcfa82f287c9da56abf
cve_assigned1666821600 (10/27/2022)1666821600 (10/27/2022)
cve_nvd_summaryA vulnerability, which was classified as problematic, was found in Exiv2. This affects the function QuickTimeVideo::decodeBlock of the file quicktimevideo.cpp of the component QuickTime Video Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The name of the patch is 459910c36a21369c09b75bcfa82f287c9da56abf. It is recommended to apply a patch to fix this issue. The identifier VDB-212349 was assigned to this vulnerability.

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!