CVE-2021-45263 — Use After Free in Gpac

CWE-416 — Use After Free4 documents4 sources

Severity

5.5MEDIUMNVD

EPSS

0.1%

top 75.48%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gpac Debian Gpac

Timeline

PublishedDec 22

Latest updateDec 23

Description

An invalid free vulnerability exists in gpac 1.1.0 via the gf_svg_delete_attribute_value function, which causes a segmentation fault and application crash.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/gpac< gpac 1.0.1+dfsg1-4+deb11u2 (bullseye)

▶Debiangpac/gpac< 1.0.1+dfsg1-4+deb11u2

▶NVDgpac/gpac1.1.0

🔴Vulnerability Details

GHSA

GHSA-fvx8-gwc7-qjhw: An invalid free vulnerability exists in gpac 1↗2021-12-23

▶

OSV

CVE-2021-45263: An invalid free vulnerability exists in gpac 1↗2021-12-22

▶

📋Vendor Advisories

Debian

CVE-2021-45263: gpac - An invalid free vulnerability exists in gpac 1.1.0 via the gf_svg_delete_attribu...↗2021

▶