PT-2021-17842 · Gpac+1 · Gpac+1

Nigelxo · Published 2021-04-14 · Updated 2021-04-21 · CVE-2021-28300

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GPAC version 0.5.2

Description: A NULL pointer dereference issue exists in the isomedia/track.c module's MergeTrack() function, allowing attackers to execute arbitrary code or cause a Denial-of-Service (DoS) by uploading a malicious MP4 file.

Recommendations: For GPAC version 0.5.2, consider disabling the MergeTrack() function until a patch is available to prevent exploitation. Restrict access to uploading MP4 files to minimize the risk of arbitrary code execution or DoS.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-28300

Affected Products

Debian

Gpac

References · 8

• 🔥 https://github.com/gpac/gpac/issues/1702 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-28300 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28300 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-28300 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-28300 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28300 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-28300 · Security Note
• https://ubuntu.com/security/CVE-2021-28300 · Vendor Advisory