CVE-2021-31261

The gfhintertracknew function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command...

CVE-2021-31256

CVE-2021-31256 affects GPAC 1.0.1’s MP4Box via a memory leak in stbl_GetSampleInfos that allows memory reads from a crafted file. Affected software/version: GPAC 1.0.1. Underlying cause: memory leak in stbl_GetSampleInfos. Impact: information disclosure via crafted input. Mitigation: upgrade to G...

CVE-2021-31259

GPAC 1.0.1 contains a NULL pointer dereference in gf_isom_cenc_get_default_info_internal triggered by a crafted MP4Box file, enabling a denial of service. Upstream Gentoo GLSA recommends upgrading to GPAC >= 2.2.0. Connected sources confirm affected version and remediation guidance.

CVE-2021-31257

GPAC 1.0.1 contains a vulnerability in the HintFile function that can cause a denial of service via a crafted MP4Box file (NULL pointer dereference). Several sources (CVE-2021-31257 entries in NVD/OSV/CNVD, CNC-derived advisories) confirm the issue. Affected component: GPAC, vulnerable function: ...

CVE-2021-31255

CVE-2021-31255 concerns GPAC, specifically a buffer overflow in the abst_box_read function of MP4Box in GPAC 1.0.1. The vulnerability can lead to denial of service or arbitrary code execution via a crafted MP4 file. Several connected sources corroborate this issue across multiple databases and ad...

CVE-2021-31258

CVE-2021-31258 affects GPAC 1.0.1: the function gf_isom_set_extraction_slc can trigger a NULL pointer dereference when processing a crafted MP4Box file, leading to denial of service. Exploitation details are not provided in the available documents. Remediation visible in Gentoo GLSA 2024-08-21 re...

CVE-2021-31257

The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

CVE-2021-31262

The AV1DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

CVE-2021-31262

The AV1DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

CVE-2021-31260

CVE-2021-31260 affects GPAC 1.0.1: the MergeTrack function can be triggered by a crafted MP4Box file, causing a NULL pointer dereference and a denial of service. Exploitation details are not provided beyond this description in the sources, but multiple advisories reference a vulnerability in GPAC...

CVE-2021-31262

GPAC 1.0.1 has a NULL pointer dereference in AV1_DuplicateConfig that can be triggered by a crafted MP4Box file, leading to denial of service. This CVE (CVE-2021-31262) is reported across multiple sources (NVD entry and CNVD/OSV/Gentoo advisories) with the same root cause. Affected component: GPA...

CVE-2021-31262

Removed by vendor...

CVE-2021-31259

Removed by vendor...

CVE-2021-31254

Removed by vendor...

CVE-2021-31255

Removed by vendor...

CVE-2021-31261

Removed by vendor...

CVE-2021-31260

Removed by vendor...

CVE-2021-31258

Removed by vendor...

CVE-2021-31257

Removed by vendor...

PT-2021-19226

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is related to the MergeTrack function. Recommendations For...