PT-2024-37358 · Gpac+2 · Gpac+2

Fantasy · Published 2024-06-17 · Updated 2024-09-25 · CVE-2024-6064

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: GPAC version 2.5-DEV-rev228-g11067ea92-master

Description: A problem was found in the function xmt node end of the file src/scene manager/loader xmt.c of the component MP4Box. The issue leads to use after free. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Recommendations: To fix this issue, apply the patch f4b3e4d2f91bc1749e7a924a8ab171af03a355a8/c1b9c794bad8f262c56f3cf690567980d96662f5. As a temporary workaround, consider disabling the xmt node end function until the patch is applied. Restrict access to the loader xmt.c file to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2024-6064

Affected Products

Astra Linux

Debian

Gpac

References · 15

• 🔥 https://github.com/gpac/gpac/issues/2874 · Exploit
• 🔥 https://github.com/user-attachments/files/15801189/poc.zip · Exploit
• https://github.com/gpac/gpac/commit/c1b9c794bad8f262c56f3cf690567980d96662f5 · Patch
• https://ubuntu.com/security/CVE-2024-6064 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-6064 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6064 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6064 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-6064 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-6064 · Vendor Advisory
• https://t.me/cvenotify/83583 · Telegram Post
• https://vuldb.com/?ctiid.268792 · Note
• https://t.me/cvenotify/95978 · Telegram Post
• https://vuldb.com/?submit.356316 · Note
• https://vuldb.com/?id.268792 · Note