CVE-2021-28300 — NULL Pointer Dereference in Gpac

CWE-476 — NULL Pointer Dereference4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.9%
top 23.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GpacDebian CcextractorDebian Gpac
Timeline
PublishedApr 14
Latest updateMay 24

Description

NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to execute arbitrary code or cause a Denial-of-Service (DoS) by uploading a malicious MP4 file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/gpac< gpac 1.0.1+dfsg1-4 (bullseye)
▶Debiangpac/gpac< 1.0.1+dfsg1-4
▶NVDgpac/gpac0.5.2
▶debiandebian/ccextractor< gpac 1.0.1+dfsg1-4 (bullseye)

🔴Vulnerability Details

2
GHSA
GHSA-5wqc-3hgv-x49w: NULL Pointer Dereference in the "isomedia/track↗2022-05-24
▶
OSV
CVE-2021-28300: NULL Pointer Dereference in the "isomedia/track↗2021-04-14
▶

📋Vendor Advisories

1
Debian
CVE-2021-28300: ccextractor - NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" funct...↗2021
▶
CVE-2021-28300 — NULL Pointer Dereference in Gpac | cvebase