9emin1 / advisories

a list of CVE(s) discovered during my free time

advisories

gVectors: WordPress Plugin -> wpForo Forums 1.5.1

Privilege Escalation

CVE-2018-16613

Bento4 SDK and Tools v1-5-0-615

NULL Pointer Dereference

CVE-2017-12474 - Bento4 mp42ts
CVE-2017-12475 - Bento4 mp4encrypt
CVE-2017-12476 - Bento4 mp4dump

Bento4 SDK and Tools v1-5-0-616

READ/WRITE Memory Violations

CVE-2017-14257 - Ap4AtomSampleTable.cpp; result = m_SttsAtom->GetDts(index, dts, &duration);
CVE-2017-14258 - Ap4StscAtom.h; m_SampleDescriptionIndex(0) {}
CVE-2017-14259 - Ap4StscAtom.cpp; m_Entries[i].m_SamplesPerChunk = samples_per_chunk;
CVE-2017-14260 - Ap4StssAtom.cpp; m_Entries[i] = AP4_BytesToUInt32BE(&buffer[i*4]);
CVE-2017-14261 - Ap4StszAtom.cpp; for (unsigned int i=0; i<sample_count; i++)

QPDF v6.0.0

Stack Corruption

CVE-2017-12595 - QPDF

CCFile v3.6

Unauthenticated Remote Denial of Service

CVE-2017-12784 - CCFile Windows Web-based Software

MP3Gain v1.5.2.r2

Memory Access Violation

CVE-2017-12912 - MP3Gain

Stack Corruption

CVE-2017-12911 - MP3Gain

ASN1 Compiler v0.9.28

Memory Access Violation

CVE-2017-12966 - ASN1C