In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for     the ftyp atom in mp4array.h. (CVE-2018-14326)

Note that Nessus relies on the presence of the package as reported by the vendor.

Fix crash made by the new patches 

----

Fix https://nvd.nist.gov/vuln/detail/CVE-2018-14446 https://nvd.nist.gov/vuln/detail/CVE-2018-14403 https://nvd.nist.gov/vuln/detail/CVE-2018-14379 https://nvd.nist.gov/vuln/detail/CVE-2018-14326 https://nvd.nist.gov/vuln/detail/CVE-2018-14325 https://nvd.nist.gov/vuln/detail/CVE-2018-14054 based on https://github.com/TechSmith/mp4v2/pull/27 and https://github.com/sergiomb2/libmp4v2/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
261387	Linux Distros Unpatched Vulnerability : CVE-2018-14326	Nessus	Misc.	high
131105	Fedora 31 : libmp4v2 (2019-d53d4a79ac)	Nessus	Fedora Local Security Checks	critical
131092	Fedora 29 : libmp4v2 (2019-6469ad8129)	Nessus	Fedora Local Security Checks	critical
131088	Fedora 30 : libmp4v2 (2019-1030f4816a)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2018-14326

high

Tenable Plugins

high

critical

critical

critical