PT-2021-6775 · Unknown · Gpac Project On Advanced Content Library

Published 2021-05-26 · Updated 2022-09-03 · CVE-2021-21860

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GPAC Project on Advanced Content library version 1.0.1

Description An exploitable integer truncation issue exists within the MPEG-4 decoding functionality. A specially crafted MPEG-4 input can cause improper memory allocation, resulting in a heap-based buffer overflow that causes memory corruption. The FOURCC code, 'trik', is parsed by the function within the library. An attacker can convince a user to open a video to trigger this issue.

Recommendations For GPAC Project on Advanced Content library version 1.0.1, consider disabling the MPEG-4 decoding functionality until a patch is available. Restrict access to videos that could potentially trigger this issue to minimize the risk of exploitation. Avoid using the 'trik' FOURCC code in the affected library until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-680

CWE-681

Related Identifiers

BDU:2022-02167

CVE-2021-21860

DSA-4966-1

MGASA-2021-0431

Affected Products

Gpac Project On Advanced Content Library

References · 20

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1298 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21860 · Security Note
• https://osv.dev/vulnerability/DSA-4966-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02167 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21860 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21860 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21860 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0431 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21860 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21860 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0431.html · Security Note
• https://debian.org/security/2021/dsa-4966 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21860 · Vendor Advisory
• https://github.com/gpac/gpac/commit/8cd33e8977fd5f4215e4b67c309fd403762bfeb7 · Note
• https://github.com/gpac/gpac/issues/1814 · Note