PT-2021-18661 · Gpac · Gpac

Treebacker · Published 2021-04-19 · Updated 2021-04-21 · CVE-2021-30199

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1

Description The issue is related to a Null Pointer Dereference in the gf filter pck get data function, which can be triggered by a crafted mp4 file. This results in a crash when the first argument pck is null.

Recommendations For GPAC version 1.0.1, consider avoiding the use of crafted mp4 files that may cause the gf filter pck get data function to be called with a null pck argument until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-30199

Affected Products

Gpac

References · 10

• 🔥 https://github.com/gpac/gpac/issues/1728 · Exploit
• https://github.com/gpac/gpac/commit/b2db2f99b4c30f96e17b9a14537c776da6cb5dca · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-30199 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-30199 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30199 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-30199 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-30199 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-30199 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30199 · Vendor Advisory
• https://t.me/cvenotify/13473 · Telegram Post