PT-2021-6535 · Gpac · Gpac

5N1P3R001 · Published 2021-09-13 · Updated 2023-05-27 · CVE-2021-33361

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GPAC version 1.0.1

Description The issue is related to a memory leak in the afra box read function in MP4Box, a component of the GPAC multimedia platform. This allows attackers to read memory via a crafted file, potentially giving them access to confidential data. The exploitation of this issue can be done remotely.

Recommendations For GPAC version 1.0.1, consider disabling the afra box read function until a patch is available to prevent potential memory leaks and unauthorized access to data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Memory Leak

Weakness Enumeration

CWE-119

CWE-401

Related Identifiers

BDU:2022-01795

CVE-2021-33361

DSA-5411-1

Affected Products

Gpac

References · 15

• 🔥 https://github.com/gpac/gpac/issues/1782 · Exploit
• https://github.com/gpac/gpac/commit/a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f · Patch
• https://ubuntu.com/security/CVE-2021-33361 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33361 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33361 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33361 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5411-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01795 · Security Note
• https://debian.org/security/2023/dsa-5411 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33361 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-33361 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-33361 · Vendor Advisory
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.11 · Note
• https://t.me/cibsecurity/28758 · Telegram Post
• https://t.me/cvenotify/20805 · Telegram Post