PT-2022-26208 · Gpac · Gpac

Ajakko · Published 2022-11-29 · Updated 2023-05-27 · CVE-2022-4202

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPAC version 2.1-DEV-rev490-g68064e101-master

Description A problematic vulnerability was found in GPAC, affecting the function lsr translate coords of the file laser/lsr dec.c. The manipulation leads to integer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, it is recommended to apply a patch, specifically the patch b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908. As a temporary workaround, consider disabling the lsr translate coords function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2022-4202

DSA-5411-1

Affected Products

Gpac

References · 18

• 🔥 https://github.com/gpac/gpac/issues/2333 · Exploit
• 🔥 https://drive.google.com/file/d/1HVWa6IpAbvsMS5rx091RfjUB4GfXrMLE/view · Exploit
• https://github.com/gpac/gpac/commit/b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908 · Patch
• https://cve.org/CVERecord?id=CVE-2022-4202 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4202 · Security Note
• https://osv.dev/vulnerability/DSA-5411-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4202 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4202 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4202 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-4202 · Vendor Advisory
• https://debian.org/security/2023/dsa-5411 · Vendor Advisory
• https://t.me/cvenotify/38652 · Telegram Post
• https://t.me/cvenotify/43318 · Telegram Post
• https://t.me/cvenotify/38965 · Telegram Post