CVE-2023-38858
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code...
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
- Record
CVE-2023-38858- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
- Record
CVE-2023-38858- Updated
- 2026-11-02
EUVDEUVD-2023-42631 No score
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
- Record
EUVD-2023-42631- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-46fj-h774-mfxr
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code...
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
- Record
GHSA-46fj-h774-mfxr- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-38858
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
- Record
UBUNTU-CVE-2023-38858- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
- Record
CVE-2023-38858- Updated
- 2026-11-02
OSVUSN-6313-1 No score
faad2 vulnerabilities
It was discovered that FAAD2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2021-32272, CVE-2021-32273, CVE-2021-32274, CVE-2021-32277, CVE-2021-32278, CVE-2023-38857, CVE-2023-38858)
It was discovered that FAAD2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2021-32276)
- Record
USN-6313-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
faad2Ubuntu:Pro:14.04:LTS |
before 2.7-8+deb8u3ubuntu0.1~esm1, plus listed versions 2.7-82.7-8+deb7u1build0.14.04.12.7-8+deb8u3build0.14.04.1~esm1 |
2.7-8+deb8u3ubuntu0.1~esm1 |
faad2Ubuntu:Pro:16.04:LTS |
before 2.8.0~cvs20150510-1ubuntu0.1+esm1, plus listed versions 2.8.0~cvs20150510-12.8.0~cvs20150510-1ubuntu0.1 |
2.8.0~cvs20150510-1ubuntu0.1+esm1 |
faad2Ubuntu:Pro:18.04:LTS |
before 2.8.8-1ubuntu0.1~esm1, plus listed versions 2.8.1-22.8.5-12.8.6-12.8.8-1 |
2.8.8-1ubuntu0.1~esm1 |
faad2Ubuntu:20.04:LTS |
before 2.9.1-1ubuntu0.1, plus listed versions 2.8.8-3.22.9.0-12.9.1-1 |
2.9.1-1ubuntu0.1 |
faad2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.10.1-12.11.1-12.11.1-1build1 |
None known |
faad2Ubuntu:25.10 |
All versions, plus listed versions 2.11.2-1 |
None known |
faad2Ubuntu:26.10 |
All versions, plus listed versions 2.11.2-1build1 |
None known |
faad2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.11.2-12.11.2-1build1 |
None known |
faad2Ubuntu:Pro:14.04:LTS From an advisory covering 8 CVEs |
before 2.7-8+deb8u3ubuntu0.1~esm1, plus listed versions 2.7-82.7-8+deb7u1build0.14.04.12.7-8+deb8u3build0.14.04.1~esm1 |
2.7-8+deb8u3ubuntu0.1~esm1 |
faad2Ubuntu:Pro:16.04:LTS From an advisory covering 8 CVEs |
before 2.8.0~cvs20150510-1ubuntu0.1+esm1, plus listed versions 2.8.0~cvs20150510-12.8.0~cvs20150510-1ubuntu0.1 |
2.8.0~cvs20150510-1ubuntu0.1+esm1 |
faad2Ubuntu:Pro:18.04:LTS From an advisory covering 8 CVEs |
before 2.8.8-1ubuntu0.1~esm1, plus listed versions 2.8.1-22.8.5-12.8.6-12.8.8-1 |
2.8.8-1ubuntu0.1~esm1 |
faad2Ubuntu:20.04:LTS From an advisory covering 8 CVEs |
before 2.9.1-1ubuntu0.1, plus listed versions 2.8.8-3.22.9.0-12.9.1-1 |
2.9.1-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-38858 is a medium vulnerability (CVSS 6.5) in Faad2 Project Faad2, published August 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in faad2 2.7-8+deb8u3ubuntu0.1~esm1.
References
github.com/knik0/faad2/issues/173
security.gentoo.org/glsa/202401-13
nvd.nist.gov/vuln/detail/CVE-2023-38858
ubuntu.com/security/CVE-2023-38858
Show 9 moreShow less
cve.org/CVERecord?id=CVE-2023-38858