Bug 1644258 (CVE-2018-4022) - CVE-2018-4022 mkvtoolnix: MKVINFO read_one_element code execution vulnerability
Summary: CVE-2018-4022 mkvtoolnix: MKVINFO read_one_element code execution vulnerability
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2018-4022
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1644259 1644260
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-10-30 10:26 UTC by Andrej Nemec
Modified: 2021-02-16 22:51 UTC (History)
5 users (show)

Fixed In Version: mkvtoolnix-28.2.0-1.el7,mkvtoolnix-28.2.0-1.fc28,mkvtoolnix-28.2.0-1.fc29,mkvtoolnix-28.2.0-1.fc27
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-12-25 23:20:02 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2018-10-30 10:26:26 UTC 
A use-after-free vulnerability exists in the way MKVToolNix MKVINFO v25.0.0 handles the MKV (matroska) file format. A specially crafted MKV file can cause arbitrary code execution in the context of the current user.

External References:

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0694
Comment 1 Andrej Nemec 2018-10-30 10:27:11 UTC 
Created mkvtoolnix tracking bugs for this issue:

Affects: epel-all [bug 1644260]
Affects: fedora-all [bug 1644259]
Comment 2 Dominik 'Rathann' Mierzejewski 2018-10-30 10:30:36 UTC 
What's the point of this bug? We have 27.0.0 in Fedora and EPEL7 already.
Comment 3 Dominik 'Rathann' Mierzejewski 2018-10-30 10:32:51 UTC 
Ah, your description is misleading. It looks like versions up to 28.1.0 are affected:

https://mkvtoolnix.download/doc/NEWS.md

# Version 28.2.0 "The Awakening" 2018-10-25

## Bug fixes

* mkvmerge, mkvinfo, mkvextract, mkvpropedit, MKVToolNix GUI's info tool &
  chapter editor: fixed a case of memory being accessed after it had been
  freed earlier. This can be triggered by specially crafted Matroska files and
  lead to arbitrary code execution. The vulnerability was reported as Cisco
  TALOS 2018-0694 on 2018-10-25.
Note You need to log in before you can comment on or make changes to this bug.