FLVMeta vulnerabilities

A vulnerability was found in FLVMeta up to 1.2.2 in the function amf_object_get in src/amf.c during AMF object parsing. The manipulation causes a null pointer dereference. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in FLVMeta up to 1.2.2 in the function amf_string_new in src/amf.c during AMF string processing. Manipulation of the length argument results in a heap-based buffer overflow. The attack can be launched remotely, and the exploit has been made public.

FLVMeta v1.2.1 was found to contain a buffer overflow in the xml_on_metadata_tag_only function at dump_xml.c.