PT-2019-6174 · Gpac+1 · Gpac+1

Strongcourage · Published 2018-12-19 · Updated 2021-07-30 · CVE-2020-19481

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GPAC versions prior to 0.8.0

Description The issue is related to an invalid memory read in the gf m2ts process pmt function within the media tools/mpegts.c component of the GPAC multimedia platform. This can cause a denial of service when a crafted MP4 file is processed. The vulnerability can be exploited by a remote attacker to disrupt service.

Recommendations For GPAC versions prior to 0.8.0, update to version 0.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the gf m2ts process pmt function in media tools/mpegts.c to minimize the risk of exploitation. Avoid using crafted MP4 files that could trigger the denial of service until the issue is resolved.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2018-2923

BDU:2022-01670

CVE-2020-19481

Affected Products

Alt Linux

Gpac

References · 11

• 🔥 https://github.com/gpac/gpac/issues/1265 · Exploit
• 🔥 https://github.com/gpac/gpac/issues/1267 · Exploit
• 🔥 https://github.com/gpac/gpac/issues/1266 · Exploit
• https://github.com/gpac/gpac/commit/2320eb73afba753b39b7147be91f7be7afc0eeb7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-19481 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-19481 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01670 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-19481 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-19481 · Vendor Advisory
• https://t.me/cvenotify/18380 · Telegram Post
• https://t.me/cvenotify/17972 · Telegram Post