PT-2021-19224

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is due to a problem in the gf isom set extraction slc...

PT-2021-19228

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is due to a problem in the AV1 DuplicateConfig function...

PT-2021-19226

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is related to the MergeTrack function. Recommendations For...

PT-2021-19220

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description A buffer overflow issue exists in the tenc box read function in MP4Box, allowing attackers to potentially cause a denial of service or execute arbitrary code via a crafted file. This issue is related to invalid I...

PT-2021-19223

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is related to the HintFile function. Recommendations For GPA...

PT-2021-19227

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description The issue allows attackers to read memory via a crafted file in the MP4Box command, specifically through the gf hinter track new function. Recommendations For GPAC version 1.0.1, consider restricting the use of t...

PT-2021-19221

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description A buffer overflow issue exists in the abst box read function within MP4Box in GPAC, allowing attackers to potentially cause a denial of service or execute arbitrary code by using a crafted file. No information is...

PT-2021-19222

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1 Description A memory leak in the stbl GetSampleInfos function in MP4Box allows attackers to read memory via a crafted file. Recommendations For GPAC version 1.0.1, at the moment, there is no information about a newer version...

Arbitrary Code Execution

GPAC is vulnerable to arbitrary code execution. A buffer overflow vulnerability occurs in the catmultiplefiles function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames. This allows an attacker to execute arbitrary code on the host OS...

CVE-2020-11558

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audiosampleentryRead in isomedia/boxcodebase.c does not properly decide when to make gfisomboxdel calls. This leads to various use-after-free outcomes involving mdiaRead, gfisomdeletemovie, and gfisomparsemovieboxes...

CVE-2020-11558

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audiosampleentryRead in isomedia/boxcodebase.c does not properly decide when to make gfisomboxdel calls. This leads to various use-after-free outcomes involving mdiaRead, gfisomdeletemovie, and gfisomparsemovieboxes...

CVE-2020-11558

CVE-2020-11558 affects GPAC 0.8.0 (libgpac.a) and is demonstrated by MP4Box. The issue is in audio_sample_entry_Read within isomedia/box_code_base.c, which does not correctly decide when to call gf_isom_box_del, enabling use-after-free scenarios involving mdia_Read, gf_isom_delete_movie, and gf_i...

CVE-2020-11558

Removed by vendor...

CVE-2020-11558: Use After Free

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audiosampleentryRead in isomedia/boxcodebase.c does not properly decide when to make gfisomboxdel calls. This leads to various use-after-free outcomes involving mdiaRead, gfisomdeletemovie, and gfisomparsemovieboxes...

CVE-2019-20630

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in BSReadByte called from gfbsreadbit in utils/bitstream.c that can cause a denial of service via a crafted MP4 file...

DEBIAN-CVE-2019-20630

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in BSReadByte called from gfbsreadbit in utils/bitstream.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20628

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a Use-After-Free vulnerability in gfm2tsprocesspmt in mediatools/mpegts.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20630

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in BSReadByte called from gfbsreadbit in utils/bitstream.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20628

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a Use-After-Free vulnerability in gfm2tsprocesspmt in mediatools/mpegts.c that can cause a denial of service via a crafted MP4 file...

CVE-2019-20629

An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in gfm2tsprocesspmt in mediatools/mpegts.c that can cause a denial of service via a crafted MP4 file...