PT-2019-10440 · Gpac+1 · Gpac+1

Marsman1996 · Publicado 2019-09-16 · Atualizado 2023-02-28 · CVE-2018-21015

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GPAC version 0.7.1

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a crafted file. This occurs because the cfg variable could be NULL when the line cfg new->AVCLevelIndication = cfg->AVCLevelIndication; is executed in the AVC DuplicateConfig() function at isomedia/avc ext.c.

Recommendations For GPAC version 0.7.1, consider adding a NULL check for the cfg variable before accessing its members in the AVC DuplicateConfig() function to prevent the NULL pointer dereference.

Exploit

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2018-21015

DLA-2072-1

MGASA-2020-0137

Produtos afetados

Debian

Gpac

Referências · 38

• 🔥 https://github.com/gpac/gpac/issues/1179 · Exploit
• https://github.com/gpac/gpac/issues/1338 · Nota
• https://github.com/gpac/gpac/issues/1335 · Nota
• https://github.com/gpac/gpac/issues/1327 · Nota
• https://github.com/gpac/gpac/issues/1328 · Nota
• https://github.com/gpac/gpac/issues/1320 · Nota
• https://github.com/gpac/gpac/issues/1348 · Nota
• https://github.com/gpac/gpac/issues/1250 · Nota
• https://github.com/gpac/gpac/issues/1180 · Nota
• https://github.com/gpac/gpac/issues/1337 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20170 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-21015 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20161 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/gpac · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2020-0137.html · Nota de Segurança