PT-2021-6520 · Unknown · Gpac Project On Advanced Content Library

Published 2021-08-16 · Updated 2022-05-31 · CVE-2021-21861

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GPAC Project on Advanced Content library version 1.0.1

Description An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality. When processing the 'hdlr' FOURCC code, a specially crafted MPEG-4 input can cause an improper memory allocation resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability, potentially allowing the attacker to access confidential data, disrupt its integrity, and cause a denial of service.

Recommendations For GPAC Project on Advanced Content library version 1.0.1, consider disabling the MPEG-4 decoding functionality until a patch is available to prevent exploitation. Restrict access to videos that could potentially trigger this vulnerability to minimize the risk of memory corruption and data integrity disruption. Avoid using the 'hdlr' FOURCC code in the affected MPEG-4 decoding functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-680

CWE-681

Related Identifiers

BDU:2022-01780

CVE-2021-21861

DSA-4966-1

MGASA-2021-0431

Affected Products

Gpac Project On Advanced Content Library

References · 20

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1298 · Exploit
• https://osv.dev/vulnerability/DSA-4966-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01780 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0431 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21861 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21861 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21861 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21861 · Security Note
• https://debian.org/security/2021/dsa-4966 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21861 · Security Note
• https://advisories.mageia.org/MGASA-2021-0431.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-21861 · Vendor Advisory
• https://github.com/gpac/gpac/commit/8cd33e8977fd5f4215e4b67c309fd403762bfeb7 · Note
• https://github.com/gpac/gpac/issues/1814 · Note