CVE-2018-20762 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Gpac

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer5 documents5 sources

Severity

7.8HIGHNVD

EPSS

0.2%

top 53.88%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gpac Debian Gpac Gpac Project Gpac +2 more

Timeline

PublishedFeb 6

Latest updateMay 14

Description

GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/gpac< gpac 0.5.2-426-gc5ad4e4+dfsg5-4.1 (bullseye)

▶Debiangpac/gpac< 0.5.2-426-gc5ad4e4+dfsg5-4.1

▶NVDgpac_project/gpac0.7.1

Also affects: Debian Linux 8.0, Ubuntu Linux 16.04, 18.04, 18.10

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

GHSA

GHSA-rpmm-2h25-mg88: GPAC version 0↗2022-05-14

▶

OSV

CVE-2018-20762: GPAC version 0↗2019-02-06

▶

📋Vendor Advisories

Ubuntu

GPAC vulnerabilities↗2019-03-29

▶

Debian

CVE-2018-20762: gpac - GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_mu...↗2018

▶