CVE-2022-36191

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by MP4Box. This vulnerability was fixed in commit fef6242.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gpac/gpac/issues/2218Exploit, Issue Tracking, Patch, Third Party Advisory
https://www.debian.org/security/2023/dsa-5411
https://github.com/gpac/gpac/issues/2218Exploit, Issue Tracking, Patch, Third Party Advisory
https://www.debian.org/security/2023/dsa-5411

Timeline

Published: Aug 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-361939.8SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the applicatio CVE-2022-361945.4Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload in CVE-2022-361975.4BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a c CVE-2022-361989.8Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-report CVE-2022-36209.8A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the CVE-2022-362007.5In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.CVE-2022-362019.8Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php.CVE-2022-362029.8Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Brok CVE-2022-362036.1Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel. In addition, it leads to takeover the admin CVE-2022-36216.5A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the CVE-2022-362157.2DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.CVE-2022-362167.2DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php.