MGASA-2020-0062 - Updated libmp4v2 packages fix security vulnerabilities

Publication date: 28 Jan 2020
URL: https://advisories.mageia.org/MGASA-2020-0062.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2018-14325,
     CVE-2018-14326,
     CVE-2018-14379,
     CVE-2018-14403,
     CVE-2018-14446

Updated libmp4v2 packages fix security vulnerabilities:

The libmp4v2 library through version 2.1.0 is vulnerable to an integer
underflow when parsing an MP4Atom in mp4atom.cpp. An attacker could exploit
this to cause a denial of service via crafted MP4 file (CVE-2018-14325).

The libmp4v2 library through version 2.1.0 is vulnerable to an integer
overflow and resultant heap-based buffer overflow when resizing an MP4Array
for the ftyp atom in mp4array.h. An attacker could exploit this to cause a
denial of service via crafted MP4 file (CVE-2018-14326).

MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the
MP4ItemAtom data type in a certain case where MP4DataAtom is required, which
allows remote attackers to cause a denial of service (memory corruption) or
possibly have unspecified other impact via a crafted MP4 file, because access
to the data structure has different expectations about layout as a result of
this type confusion (CVE-2018-14379).

MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of
atom names, leading to use of an inappropriate data type for associated atoms.
The resulting type confusion can cause out-of-bounds memory access
(CVE-2018-14403).

MP4Integer32Property::Read in atom_avcC.cpp in MP4v2 2.1.0 allows remote
attackers to cause a denial of service (heap-based buffer overflow and
application crash) or possibly have unspecified other impact via a crafted
MP4 file (CVE-2018-14446).

References:
- https://bugs.mageia.org/show_bug.cgi?id=25962
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14325
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14326
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14379
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14403
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14446

SRPMS:
- 7/core/libmp4v2-2.1.0-0.4.mga7