Lucene search

VulDBCVELIST:CVE-2024-6061

HistoryJun 17, 2024 - 7:31 p.m.

CVE-2024-6061 GPAC MP4Box isoffin_read.c isoffin_process infinite loop

2024-06-1719:31:07

CWE-835

VulDB

www.cve.org

vulnerability gpac mp4box isoffin_read.c infinite loop local host patch 20c0f29139a82779b86453ce7f68d0681ec7624c vdb-268789

1.7 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:N/I:N/A:P

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.8 Medium

CVSS4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:N/SI:N/VA:L/SA:N

0.0004 Low

EPSS

Percentile

10.4%

JSON

A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "GPAC",
    "versions": [
      {
        "version": "2.5-DEV-rev228-g11067ea92-master",
        "status": "affected"
      }
    ],
    "modules": [
      "MP4Box"
    ]
  }
]

References

github.com/gpac/gpac/commit/20c0f29139a82779b86453ce7f68d0681ec7624c

github.com/gpac/gpac/issues/2871

github.com/user-attachments/files/15801058/poc1.zip

vuldb.com/?ctiid.268789

vuldb.com/?id.268789

vuldb.com/?submit.356308

1.7 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:N/I:N/A:P

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.8 Medium

CVSS4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:N/SI:N/VA:L/SA:N

0.0004 Low

EPSS

Percentile

10.4%

JSON

Related for CVELIST:CVE-2024-6061