CVE-2018-14403

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated atoms. The resulting type confusion can cause out-of-bounds memory access.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-704

Affected software

No affected versions have been published.

Timeline

Published: Jul 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-144046.5A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invali CVE-2018-14416.1IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.3 and 8.1.4) is vulnerable to cross-site scripti CVE-2018-144156.1An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=CVE-2018-144179.8A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv scrip CVE-2018-144189.8In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.CVE-2018-144194.8MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.CVE-2018-14428.8IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery w CVE-2018-144208.8MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?an CVE-2018-144218.8SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /bac CVE-2018-144226.1blog/index.php in SansCMS 0.7 has XSS via the q parameter.CVE-2018-144237.5Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.CVE-2018-144247.8The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a