CVE-2022-3957

A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio of the file scenegraph/svg_attributes.c of the component SVG Parser. The manipulation leads to memory leak. The attack can be launched remotely. The name of the patch is 2191e66aa7df750e8ef01781b1930bea87b713bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213463.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/gpac/gpac/commit/2191e66aa7df750e8ef01781b1930bea87b713bb	Patch Third Party Advisory
https://vuldb.com/?id.213463	Permissions Required Third Party Advisory VDB Entry
https://www.debian.org/security/2023/dsa-5411
https://github.com/gpac/gpac/commit/2191e66aa7df750e8ef01781b1930bea87b713bb	Patch Third Party Advisory
https://vuldb.com/?id.213463	Permissions Required Third Party Advisory VDB Entry
https://www.debian.org/security/2023/dsa-5411

Configurations

Configuration 1 (hide)

cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-11-11 16:15

Updated : 2024-11-21 07:20

NVD link : CVE-2022-3957

Mitre link : CVE-2022-3957

CVE.ORG link : CVE-2022-3957

JSON object : View

Products Affected

gpac

gpac

CWE

CWE-404

Improper Resource Shutdown or Release

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2022-3957", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-11-11T16:15:16.707", "references": [{"url": "https://github.com/gpac/gpac/commit/2191e66aa7df750e8ef01781b1930bea87b713bb", "tags": ["Patch", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.213463", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://www.debian.org/security/2023/dsa-5411", "source": "cna@vuldb.com"}, {"url": "https://github.com/gpac/gpac/commit/2191e66aa7df750e8ef01781b1930bea87b713bb", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?id.213463", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2023/dsa-5411", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-404"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio of the file scenegraph/svg_attributes.c of the component SVG Parser. The manipulation leads to memory leak. The attack can be launched remotely. The name of the patch is 2191e66aa7df750e8ef01781b1930bea87b713bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213463."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en GPAC y clasificada como problem\u00e1tica. La funci\u00f3n svg_parse_preserveaspectratio del archivo scenegraph/svg_attributes.c del componente SVG Parser es afectada por esta vulnerabilidad. La manipulaci\u00f3n conduce a una p\u00e9rdida de memoria. El ataque se puede lanzar de forma remota. El nombre del parche es 2191e66aa7df750e8ef01781b1930bea87b713bb. Se recomienda aplicar un parche para solucionar este problema. El identificador asociado de esta vulnerabilidad es VDB-213463."}], "lastModified": "2024-11-21T07:20:36.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4D3D58A-C3C9-4441-A84A-FB91FD19985C", "versionEndExcluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}