Exiv2 QuickTime Video quicktimevideo.cpp userDataDecoder denial of service 🚫 [Fałszywie Pozytywny]

Ten problem wydaje się być fałszywie pozytywny. Proszę zweryfikować podane źródła i rozważyć, czy w ogóle nie skorzystać z tego wpisu.

Pole2022-11-21 13:112022-11-26 14:062022-11-26 14:09
nameExiv2Exiv2Exiv2
componentQuickTime Video HandlerQuickTime Video HandlerQuickTime Video Handler
filequicktimevideo.cppquicktimevideo.cppquicktimevideo.cpp
functionQuickTimeVideo::userDataDecoderQuickTimeVideo::userDataDecoderQuickTimeVideo::userDataDecoder
cwe476 (odmowa usługi)476 (odmowa usługi)476 (odmowa usługi)
risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
urlhttps://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52382https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52382https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52382
namePoprawkaPoprawkaPoprawka
patch_name6bb956ad808590ce2321b9ddf6772974da27c4ca6bb956ad808590ce2321b9ddf6772974da27c4ca6bb956ad808590ce2321b9ddf6772974da27c4ca
patch_urlhttps://github.com/Exiv2/exiv2/commit/6bb956ad808590ce2321b9ddf6772974da27c4cahttps://github.com/Exiv2/exiv2/commit/6bb956ad808590ce2321b9ddf6772974da27c4cahttps://github.com/Exiv2/exiv2/commit/6bb956ad808590ce2321b9ddf6772974da27c4ca
cveCVE-2022-3755CVE-2022-3755CVE-2022-3755
responsibleVulDBVulDBVulDB
date1666994400 (2022-10-29)1666994400 (2022-10-29)1666994400 (2022-10-29)
typeImage Processing SoftwareImage Processing SoftwareImage Processing Software
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_auNNN
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_eNDNDND
cvss3_vuldb_eXXX
cvss2_vuldb_basescore5.05.05.0
cvss2_vuldb_tempscore4.44.44.4
cvss3_vuldb_basescore4.34.34.3
cvss3_vuldb_tempscore4.14.14.1
cvss3_meta_basescore4.34.34.3
cvss3_meta_tempscore4.14.14.1
price_0day
disputed111
falsepositive111
response_summaryIssue was introduced on the main (dev) branch and fixed shortly afterwards, so none of the official releases were ever affected.Issue was introduced on the main (dev) branch and fixed shortly afterwards, so none of the official releases were ever affected.Issue was introduced on the main (dev) branch and fixed shortly afterwards, so none of the official releases were ever affected.
identifier6bb956ad808590ce2321b9ddf6772974da27c4ca6bb956ad808590ce2321b9ddf6772974da27c4ca
cve_assigned1666994400 (2022-10-29)1666994400 (2022-10-29)
cve_nvd_summaryA vulnerability was found in Exiv2 and classified as problematic. This issue affects the function QuickTimeVideo::userDataDecoder of the file quicktimevideo.cpp of the component QuickTime Video Handler. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The name of the patch is 6bb956ad808590ce2321b9ddf6772974da27c4ca. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212495.

◂ PoprzedniPrzeglądKolejny ▸

Do you need the next level of professionalism?

Upgrade your account now!