PT-2021-19227 · Gpac · Gpac

5N1P3R001 · Published 2021-04-19 · Updated 2021-04-21 · CVE-2021-31261

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1

Description The issue allows attackers to read memory via a crafted file in the MP4Box command, specifically through the gf hinter track new function.

Recommendations For GPAC version 1.0.1, consider restricting the use of the gf hinter track new function until a patch is available. Avoid using the MP4Box command with crafted files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-31261

Affected Products

Gpac

References · 9

• 🔥 https://github.com/gpac/gpac/issues/1737 · Exploit
• https://github.com/gpac/gpac/commit/cd3738dea038dbd12e603ad48cd7373ae0440f65 · Patch
• https://cve.org/CVERecord?id=CVE-2021-31261 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-31261 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-31261 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31261 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31261 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-31261 · Vendor Advisory