CVE-2021-40566
published 2022-01-12CVE-2021-40566: A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using…
PriorityP419medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.83%
53.7th percentile
A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using mp4box, which causes a denial of service.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gpac | < gpac 1.0.1+dfsg1-4+deb11u2 (bullseye) | gpac 1.0.1+dfsg1-4+deb11u2 (bullseye) |
| gpac | gpac | <= 1.0.1 | — |
| gpac | gpac | — | — |
| gpac | gpac | >= 0 < 1.0.1+dfsg1-4+deb11u2 | 1.0.1+dfsg1-4+deb11u2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7756-hh2m-ccgc: The binary MP4Box in Gpac 1
ghsa_unreviewed·2022-01-14·CVSS 5.5
CVE-2021-40575 [MEDIUM] CWE-476 GHSA-7756-hh2m-ccgc: The binary MP4Box in Gpac 1
The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566.
OSV
CVE-2021-40575: The binary MP4Box in Gpac 1
osv·2022-01-13·CVSS 5.5
CVE-2021-40575 [MEDIUM] CVE-2021-40575: The binary MP4Box in Gpac 1
The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566.
GHSA
GHSA-5xr9-fwxj-j4r9: A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1
ghsa_unreviewed·2022-01-13
CVE-2021-40566 [MEDIUM] CWE-416 GHSA-5xr9-fwxj-j4r9: A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1
A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using mp4box, which causes a denial of service.
OSV
CVE-2021-40566: A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1
osv·2022-01-12·CVSS 5.5
CVE-2021-40566 [MEDIUM] CVE-2021-40566: A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1
A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using mp4box, which causes a denial of service.
Debian
CVE-2021-40566: gpac - A Segmentation fault casued by heap use after free vulnerability exists in Gpac ...
vendor_debian·2021·CVSS 5.5
CVE-2021-40566 [MEDIUM] CVE-2021-40566: gpac - A Segmentation fault casued by heap use after free vulnerability exists in Gpac ...
A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using mp4box, which causes a denial of service.
Scope: local
bullseye: resolved (fixed in 1.0.1+dfsg1-4+deb11u2)
Debian
CVE-2021-40575: gpac - The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in ...
vendor_debian·2021·CVSS 5.5
CVE-2021-40575 [MEDIUM] CVE-2021-40575: gpac - The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in ...
The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566.
Scope: local
bullseye: resolved (fixed in 1.0.1+dfsg1-4+deb11u2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/gpac/gpac/commit/96047e0e6166407c40cc19f4e94fb35cd7624391https://github.com/gpac/gpac/issues/1887https://www.debian.org/security/2023/dsa-5411https://github.com/gpac/gpac/commit/96047e0e6166407c40cc19f4e94fb35cd7624391https://github.com/gpac/gpac/issues/1887https://www.debian.org/security/2023/dsa-5411
2022-01-12
Published