CVE-2019-20170 — Release of Invalid Pointer or Reference in Gpac

CWE-763 — Release of Invalid Pointer or Reference4 documents4 sources

Severity

5.5MEDIUMNVD

EPSS

0.5%

top 35.28%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gpac Debian Ccextractor Debian Gpac +1 more

Timeline

PublishedDec 31

Latest updateMay 24

Description

An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is an invalid pointer dereference in the function GF_IPMPX_AUTH_Delete() in odf/ipmpx_code.c.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/gpac< gpac 1.0.1+dfsg1-2 (bullseye)

▶Debiangpac/gpac< 1.0.1+dfsg1-2

▶NVDgpac/gpac0.8.0, 0.9.0+1

▶debiandebian/ccextractor< gpac 1.0.1+dfsg1-2 (bullseye)

Also affects: Debian Linux 8.0

🔴Vulnerability Details

GHSA

GHSA-4rr8-cvf6-p4f6: An issue was discovered in GPAC version 0↗2022-05-24

▶

OSV

CVE-2019-20170: An issue was discovered in GPAC version 0↗2019-12-31

▶

📋Vendor Advisories

Debian

CVE-2019-20170: ccextractor - An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. Th...↗2019

▶