CVE-2018-20763 — Out-of-bounds Write in Gpac

CWE-787 — Out-of-bounds Write5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.3%
top 49.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
GpacDebian GpacGpac Project Gpac+2 more
Timeline
PublishedFeb 6
Latest updateMay 14

Description

In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/gpac< gpac 0.5.2-426-gc5ad4e4+dfsg5-4.1 (bullseye)
▶Debiangpac/gpac< 0.5.2-426-gc5ad4e4+dfsg5-4.1

Also affects: Debian Linux 8.0, Ubuntu Linux 16.04, 18.04, 18.10

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xp5g-whvx-3f7g: In GPAC 0↗2022-05-14
▶
OSV
CVE-2018-20763: In GPAC 0↗2019-02-06
▶

📋Vendor Advisories

2
Ubuntu
GPAC vulnerabilities↗2019-03-29
▶
Debian
CVE-2018-20763: gpac - In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in...↗2018
▶
CVE-2018-20763 — Out-of-bounds Write in Debian Gpac | cvebase