CVE-2018-14379

Name	CVE-2018-14379
Description	MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted MP4 file, because access to the data structure has different expectations about layout as a result of this type confusion.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	904898

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mp4v2	source	(unstable)	(unfixed)			904898

Notes

[stretch] - mp4v2 <no-dsa> (Minor issue)
[jessie] - mp4v2 <no-dsa> (Minor issue)
https://www.openwall.com/lists/oss-security/2018/07/17/1