CVE-2023-5520
published 2023-10-11CVE-2023-5520: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
PriorityP433high7.7CVSS 3.1
AVLACLPRNUINSUCHINAH
EPSS
0.33%
24.7th percentile
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gpac | — | — |
| gpac | gpac | < 2.2.2 | 2.2.2 |
| gpac | gpac | >= 0 < 0.5.0+svn4288~dfsg1-4ubuntu1+esm2 | 0.5.0+svn4288~dfsg1-4ubuntu1+esm2 |
| gpac | gpac | >= 0 < 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1+esm2 | 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1+esm2 |
| gpac | gpac | >= 0 < 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1+esm1 | 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1+esm1 |
| gpac | gpac | >= 0 < 0.5.2-426-gc5ad4e4+dfsg5-5ubuntu0.1~esm2 | 0.5.2-426-gc5ad4e4+dfsg5-5ubuntu0.1~esm2 |
| gpac | gpac | >= 0 < 2.0.0+dfsg1-2ubuntu0.1~esm2 | 2.0.0+dfsg1-2ubuntu0.1~esm2 |
| gpac | gpac | >= 0 < 2.2.1+dfsg1-3.1ubuntu0.1~esm2 | 2.2.1+dfsg1-3.1ubuntu0.1~esm2 |
| gpac | gpac_gpac | >= unspecified < 2.2.2 | 2.2.2 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv3.04.0MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv7.7HIGH
vendor_debian7.7HIGH
vendor_ubuntu7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
gpac vulnerabilities
osv·2025-03-04·CVSS 7.7
CVE-2023-5520 [HIGH] gpac vulnerabilities
gpac vulnerabilities
It was discovered that the GPAC MP4Box utility incorrectly handled certain
AC3 files, which could lead to an out-of-bounds read. A remote attacker
could use this issue to cause MP4Box to crash, resulting in a denial of
service (system crash). This issue only affected Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2023-5520, CVE-2024-0322)
It was discovered that the GPAC MP4Box utility incorrectly handled certain
malformed text files. If a user or automated system using MP4Box were
tricked into opening a specially crafted RST file, an attacker could use
this issue to cause a denial of service (system crash) or execute arbitrary
code. (CVE-2024-0321)
OSV
CVE-2023-5520: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2
osv·2023-10-11·CVSS 7.7
CVE-2023-5520 [HIGH] CVE-2023-5520: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
GHSA
GHSA-8x9m-4hhm-x696: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2
ghsa_unreviewed·2023-10-11
CVE-2023-5520 [MEDIUM] CWE-125 GHSA-8x9m-4hhm-x696: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
Ubuntu
GPAC vulnerabilities
vendor_ubuntu·2025-03-04·CVSS 7.7
CVE-2024-0322 [HIGH] GPAC vulnerabilities
Title: GPAC vulnerabilities
Summary: Several security issues were fixed in GPAC.
It was discovered that the GPAC MP4Box utility incorrectly handled certain
AC3 files, which could lead to an out-of-bounds read. A remote attacker
could use this issue to cause MP4Box to crash, resulting in a denial of
service (system crash). This issue only affected Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2023-5520, CVE-2024-0322)
It was discovered that the GPAC MP4Box utility incorrectly handled certain
malformed text files. If a user or automated system using MP4Box were
tricked into opening a specially crafted RST file, an attacker could use
this issue to cause a denial of service (system crash) or execute arbitrary
code. (CVE-2024-0321)
Instructions: In general, a standard system update will make
Debian
CVE-2023-5520: gpac - Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
vendor_debian·2023·CVSS 7.7
CVE-2023-5520 [HIGH] CVE-2023-5520: gpac - Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
2023-10-11
Published