PT-2018-3515 · Gpac+2 · Gpac Mp4Box+2

Gsingh93 · Published 2018-03-06 · Updated 2019-04-10 · CVE-2018-1000100

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GPAC MP4Box versions 0.7.1 and earlier

Description: The issue is related to a buffer overflow vulnerability in the memory, which can be exploited to execute arbitrary code. This can be achieved by providing a specially crafted MP4 file to the victim, potentially leading to remote code execution (RCE). The vulnerability is located in the src/isomedia/avc ext.c file, specifically in lines 2417 to 2420.

Recommendations: For GPAC MP4Box versions 0.7.1 and earlier, consider disabling the execution of MP4 files from untrusted sources until a patch is available. As a temporary workaround, restrict access to the src/isomedia/avc ext.c file to minimize the risk of exploitation. Avoid using the vulnerable function in the affected code lines (2417 to 2420) until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-2923

BDU:2020-03255

CVE-2018-1000100

MGASA-2019-0146

USN-3926-1

Affected Products

Alt Linux

Gpac Mp4Box

Ubuntu

References · 22

• https://ubuntu.com/security/CVE-2018-1000100 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3926-1 · Vendor Advisory
• https://usn.ubuntu.com/3926-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000100 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000100 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0146.html · Security Note
• https://ubuntu.com/security/CVE-2018-7752 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000100 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20763 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20761 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13005 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03255 · Security Note
• https://ubuntu.com/security/CVE-2018-20762 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3926-1 · Vendor Advisory