GLSA-202408-21 : GPAC: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202408-21 GPAC: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in GPAC. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from th...

GPAC: Multiple Vulnerabilities

Background GPAC is an implementation of the MPEG-4 Systems standard developed from scratch in ANSI C. Description Multiple vulnerabilities have been discovered in GPAC. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

gpac:fuzz_probe_analyze: Index-out-of-bounds in hevc_ref_pic_lists_modification

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6007026208014336 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzprobeanalyze Job Type: libfuzzerubsangpac Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

ROS-20240808-01

A vulnerability in the gfm2tsprocesssdt function of the GPAC multimedia platform is related to a buffer overflow in the heap. Exploitation of the vulnerability could allow an attacker to cause a denial of service A vulnerability in the gffwrite component of the GPAC Multimedia Platform is...

ROS-20240807-06

Vulnerability in the gfavcchangevui function of the GPAC multimedia platform, related to the failure to take measures to to protect the structure of the web page. Exploitation of the vulnerability could allow an attacker to cause a denial of denial of service Vulnerability in the av1uvlc function...

gpac:fuzz_probe_analyze: Heap-buffer-overflow in hevc_ref_pic_lists_modification

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5202100800258048 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzprobeanalyze Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x7ccec61fead0...

gpac:fuzz_probe_analyze: Crash in gsfdmx_demux

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5087773365698560 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x50b100000040 Crash State: gsfdmxdemux...

Use After Free

GPAC is vulnerable to Use After Free. The vulnerability is caused by not properly freeing memory for prevl and its components before removing it from the list in the xmtnodeend function, leading to a use after free condition...

NULL Pointer Dereference

GPAC is vulnerable to NULL Pointer Dereference. The vulnerability is caused due to the lack of a null pointer check for pck-stream in the m2tsdmxonevent function, leading to a null pointer dereference...

Infinite Loop

GPAC is vulnerable to an Infinite Loop. The vulnerability is due to an infinite loop caused by the function isoffinprocess in the file src/filters/isoffinread.c. An attacker can cause the application to enter an infinite loop by manipulating the input data, which could lead to a Denial of Service...

gpac:fuzz_probe_analyze: Stack-buffer-overflow in gf_vvc_parse_nalu_bs

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4805819644837888 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 4 Crash Address: 0x799552c12e30 Crash Stat...

gpac:fuzz_probe_analyze: Index-out-of-bounds in gf_vvc_parse_nalu_bs

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4730027925635072 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzprobeanalyze Job Type: libfuzzerubsangpac Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

gpac:fuzz_probe_analyze: Heap-buffer-overflow in gf_dash_group_get_template

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6311009833254912 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzprobeanalyze Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x5020000013f1...

gpac:fuzz_probe_analyze: Heap-buffer-overflow in gf_hevc_parse_nalu_bs

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4790561396031488 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzprobeanalyze Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7f447fffead0...

gpac:fuzz_probe_analyze: Heap-buffer-overflow in filter_parse_dyn_args

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5919787339808768 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x519000021643 Crash State:...

gpac:fuzz_probe_analyze: Crash in gsfdmx_read_data_pck

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5351086341292032 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x511100062f7f Crash State:...

CVE-2024-6063

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmxonevent of the file src/filters/dmxm2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally...

DEBIAN-CVE-2024-6063

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmxonevent of the file src/filters/dmxm2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally...

CVE-2024-6064

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmtnodeend of the file src/scenemanager/loaderxmt.c of the component MP4Box. The manipulation leads to use after free. Local access is required to...

CVE-2024-6064

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmtnodeend of the file src/scenemanager/loaderxmt.c of the component MP4Box. The manipulation leads to use after free. Local access is required to...