CVE-2021-31254: Out-of-bounds Write

Buffer overflow in the tencboxread function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid IV sizes...

CVE-2021-31262: NULL Pointer Dereference

The AV1DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

CVE-2021-31257: NULL Pointer Dereference

The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

CVE-2021-31260: NULL Pointer Dereference

The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

CVE-2021-31258: NULL Pointer Dereference

The gfisomsetextractionslc function in GPAC 1.0.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted file in the MP4Box command...

CVE-2021-31261: Improper Restriction of Operations within the Bounds of a Memory Buffer

The gfhintertracknew function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command...

PT-2021-19225

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is due to a problem in the gf isom cenc get default info...

PT-2021-19224

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is due to a problem in the gf isom set extraction slc...

Arbitrary Code Execution

GPAC is vulnerable to arbitrary code execution. A buffer overflow vulnerability occurs in the catmultiplefiles function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames. This allows an attacker to execute arbitrary code on the host OS...

CVE-2020-11558

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audiosampleentryRead in isomedia/boxcodebase.c does not properly decide when to make gfisomboxdel calls. This leads to various use-after-free outcomes involving mdiaRead, gfisomdeletemovie, and gfisomparsemovieboxes...

CVE-2020-11558

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audiosampleentryRead in isomedia/boxcodebase.c does not properly decide when to make gfisomboxdel calls. This leads to various use-after-free outcomes involving mdiaRead, gfisomdeletemovie, and gfisomparsemovieboxes...

CVE-2020-11558

CVE-2020-11558 affects GPAC 0.8.0 (libgpac.a) and is demonstrated by MP4Box. The issue is in audio_sample_entry_Read within isomedia/box_code_base.c, which does not correctly decide when to call gf_isom_box_del, enabling use-after-free scenarios involving mdia_Read, gf_isom_delete_movie, and gf_i...

CVE-2020-11558

Removed by vendor...

CVE-2020-11558: Use After Free

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audiosampleentryRead in isomedia/boxcodebase.c does not properly decide when to make gfisomboxdel calls. This leads to various use-after-free outcomes involving mdiaRead, gfisomdeletemovie, and gfisomparsemovieboxes...

DEBIAN-CVE-2019-20630

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in BSReadByte called from gfbsreadbit in utils/bitstream.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20630

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in BSReadByte called from gfbsreadbit in utils/bitstream.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20628

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a Use-After-Free vulnerability in gfm2tsprocesspmt in mediatools/mpegts.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20630

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in BSReadByte called from gfbsreadbit in utils/bitstream.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20628

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a Use-After-Free vulnerability in gfm2tsprocesspmt in mediatools/mpegts.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20629

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in gfm2tsprocesspmt in mediatools/mpegts.c that can cause a denial of service via a crafted MP4 file...