PT-2023-5554 · Gpac+2 · Gpac+2

Xiaoxiaoafeifei · Published 2023-09-11 · Updated 2023-09-26 · CVE-2023-41000

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GPAC versions through 2.2.1

Description The issue is related to the incorrect use of dynamic memory in the gf bifs flush command list function of the GPAC multimedia platform. This can lead to a denial of service when exploited. The vulnerability is a use-after-free issue in the gf bifs flush command list function located in bifs/memory decoder.c.

Recommendations For GPAC versions through 2.2.1, update to a version that fixes the use-after-free vulnerability in the gf bifs flush command list function. As a temporary workaround, consider restricting access to the gf bifs flush command list function until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-06205

CVE-2023-41000

Affected Products

Debian

Gpac

Red Os

References · 13

• 🔥 https://github.com/gpac/gpac/issues/2550 · Exploit
• https://ubuntu.com/security/CVE-2023-41000 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-41000 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-41000 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-41000 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-41000 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-41000 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06205 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41000 · Vendor Advisory
• https://twitter.com/CVEnew/status/1701247448612585504 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-gpac-cve-2023-41000 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://twitter.com/VulmonFeeds/status/1701271407601086802 · Twitter Post