Vulnerabilities (CVE)

Filtered by vendor Gpac Subscribe
Total 345 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-1441 2 Debian, Gpac 2 Debian Linux, Gpac 2024-02-28 6.8 MEDIUM 7.8 HIGH
MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.
CVE-2022-24577 1 Gpac 1 Gpac 2024-02-28 6.8 MEDIUM 7.8 HIGH
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen. (gf_utf8_wcslen is a renamed Unicode utf8_wcslen function.)
CVE-2022-27147 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free vulnerability in function gf_node_get_attribute_by_tag.
CVE-2022-1035 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV.
CVE-2022-29339 1 Gpac 1 Gpac 2024-02-28 5.0 MEDIUM 7.5 HIGH
In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2.
CVE-2021-40608 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVE-2022-24575 1 Gpac 1 Gpac 2024-02-28 6.8 MEDIUM 7.8 HIGH
GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.
CVE-2020-22677 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
An issue was discovered in gpac 0.8.0. The dump_data_hex function in box_dump.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted input.
CVE-2021-46234 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can lead to a Denial of Service (DoS).
CVE-2021-46240 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c. This vulnerability can lead to a Denial of Service (DoS).
CVE-2021-44922 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
A null pointer dereference vulnerability exists in gpac 1.1.0 in the BD_CheckSFTimeOffset function, which causes a segmentation fault and application crash.
CVE-2021-45762 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf_sg_vrml_mf_reset(). This vulnerability allows attackers to cause a Denial of Service (DoS).
CVE-2021-40568 1 Gpac 1 Gpac 2024-02-28 6.8 MEDIUM 7.8 HIGH
A buffer overflow vulnerability exists in Gpac through 1.0.1 via a malformed MP4 file in the svc_parse_slice function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
CVE-2021-32139 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-46313 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
The binary MP4Box in GPAC v1.0.1 was discovered to contain a segmentation fault via the function __memmove_avx_unaligned_erms (). This vulnerability can lead to a Denial of Service (DoS).
CVE-2021-40569 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c, which allows attackers to cause a denial of service.
CVE-2021-32269 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function ilst_item_box_dump located in box_dump.c. It allows an attacker to cause Denial of Service.
CVE-2021-45288 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
A Double Free vulnerability exists in filedump.c in GPAC 1.0.1, which could cause a Denail of Service via a crafted file in the MP4Box command.
CVE-2021-44925 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_svg_get_attribute_name function, which causes a segmentation fault and application crash.
CVE-2021-46038 1 Gpac 1 Gpac 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent).