CVE-2018-20762: Improper Restriction of Operations within the Bounds of a Memory Buffer

GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the catmultiplefiles function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames...

UBUNTU-CVE-2018-20761

GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gfsmloadinit function in scenemanager.c in libgpacstatic.a...

UBUNTU-CVE-2018-20762

GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the catmultiplefiles function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames...

PT-2022-13689

Name of the Vulnerable Software and Affected Versions gpac versions prior to 2.1.0-DEV Description A null pointer dereference caused a segmentation fault in the GitHub repository gpac/gpac. Recommendations For versions prior to 2.1.0-DEV, update to version 2.1.0-DEV or later to resolve the issue...

PT-2020-10605

Name of the Vulnerable Software and Affected Versions GPAC versions prior to 0.8.0 Description A heap-based buffer over-read issue exists in the gf m2ts process pmt function in media tools/mpegts.c, which can cause a denial of service when processing a crafted MP4 file. Recommendations For versio...

PT-2019-13450

Name of the Vulnerable Software and Affected Versions GPAC versions prior to 0.8.0 Description A heap-based buffer over-read issue exists in the isomedia/isom read.c file of libgpac.a. This can cause a crash, as demonstrated by an issue in the gf m2ts sync function within media tools/mpegts.c...

PT-2019-5482

Name of the Vulnerable Software and Affected Versions GPAC versions 0.7.1 and earlier Description The issue is related to a buffer overflow in the cat multiple files function of the GPAC multimedia platform. This can be exploited to impact the confidentiality, integrity, and availability of...

PT-2022-16712

Name of the Vulnerable Software and Affected Versions gpac/gpac versions prior to 2.1-DEV Description The issue is related to a Use After Free condition in the gpac/gpac GitHub repository. Recommendations For versions prior to 2.1-DEV, update to version 2.1-DEV or later to resolve the issue...

PT-2023-3416

Name of the Vulnerable Software and Affected Versions gpac versions prior to 2.2.2 Description The issue is related to a stack-based buffer overflow in the gpac multimedia platform, specifically in the xml sax parse function. This overflow can lead to a denial of service. Recommendations For...

PT-2021-10989 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac versions prior to 1.0.1 Description: An issue was discovered in the abst box read function in box code adobe.c, which has a heap-based buffer over-read. Recommendations: For versions prior to 1.0.1, update to version 1.0.1 or later to...

PT-2021-6596 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac versions through 20200801 Description: An issue exists in the function vwid box del located in box code base.c, which allows an attacker to cause Denial of Service due to a NULL pointer dereference. This issue can be exploited by a remot...

PT-2022-11255 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: Gpac versions through 1.0.1 Description: A Segmentation fault exists caused by a null pointer dereference in the naludmx create avc decoder config function in reframe nalu.c when using mp4box, which causes a denial of service. Recommendations...

PT-2022-11256 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: Gpac versions through 1.0.2 Description: A Segmentation fault caused by null pointer dereference exists in Gpac via the avc parse slice function in av parsers.c when using mp4box, which causes a denial of service. Recommendations: For Gpac...

PT-2022-11270 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC versions prior to v1.0.1 Description: The issue is related to an infinite loop vulnerability in the ISOBMFF reader filter, specifically in the isoffin read.c file. The isoffin process function can result in a Denial of Service DoS due to...

PT-2022-11278 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 1.0.1 Description: The issue allows attackers to cause a denial of service via a crafted file in the MP4Box command, specifically through the GetHintFormat function. Recommendations: For GPAC version 1.0.1, consider disabling the...

PT-2022-13608 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac/gpac versions prior to 2.1.0-DEV Description: The issue is related to a Segmentation Fault caused by MP4Box -lsr in the GitHub repository gpac/gpac. Recommendations: For versions prior to 2.1.0-DEV, update to version 2.1.0-DEV or later t...

PT-2022-14119 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac/gpac versions prior to 2.1.0-DEV Description: The issue is related to a Use After Free condition. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this...

PT-2022-16713 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac versions prior to 2.1-DEV Description: The issue is related to an Integer Overflow or Wraparound in the GitHub repository gpac/gpac. Recommendations: For versions prior to 2.1-DEV, update to version 2.1-DEV or later to resolve the issue...

PT-2022-20926 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac/gpac versions prior to 2.1.0-DEV Description: The issue is a Buffer Over-read in the GitHub repository gpac/gpac. Recommendations: For versions prior to 2.1.0-DEV, update to version 2.1.0-DEV or later to resolve the issue...

PT-2022-21158 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac/gpac versions prior to 2.1.0-DEV Description: The issue is related to uncontrolled recursion in the GitHub repository gpac/gpac. No information is provided about the estimated number of potentially affected devices worldwide or real-worl...