GPAC vulnerabilities

A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.

A security flaw was discovered in GPAC 26.08-DEV affecting the function gf_inline_get_proto_lib in src/compositor/mpeg4_inline.c (Proto Link Handler component). The manipulation results in a use-after-free condition, and the attack requires local access. The exploit has been publicly released and may be used for attacks.

A vulnerability was determined in GPAC 26.08-DEV affecting the function gf_node_deactivate_ex in src/scenegraph/base_scenegraph.c (MP4Box component). Executing a manipulation can lead to a use-after-free condition, and the attack requires local access. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.

A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.

A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.

A vulnerability was detected in GPAC up to 26.07.0 affecting the function gf_fq_pop of the file filter_core/filter_queue.c of the MP4Box component. Manipulation results in use after free, and the attack may be initiated remotely. The exploit is now public and may be used; the vendor was contacted early but did not respond.

A security vulnerability has been detected in GPAC up to 26.07.0 affecting the function gf_mx_v of the file utils/os_thread.c of the MP4Box component. Manipulation leads to use after free, and the attack can be launched remotely. The exploit has been disclosed publicly and may be used; the vendor was contacted early but did not respond.

GPAC up to 26.07.0 has a buffer overflow vulnerability in the function gf_dash_resolve_url in src/media_tools/dash_client.c of the DASH Client component. The attack can be carried out remotely. Upgrading to version abi-16.26 resolves the issue.

A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.

A vulnerability was identified in GPAC 26.08-DEV affecting the function gf_rtp_parse_ttxt in src/ietf/rtp_depacketizer.c of the RTP Depacketizer component. Manipulation of the size argument leads to an out-of-bounds read. The attack can be launched remotely.

A weakness has been identified in GPAC 26.08-DEV affecting the function wait_for_header_and_parse of the file src/utils/downloader.c. Manipulation of the Content-Range argument causes an out-of-bounds read. The attack requires local access, and the exploit has been made publicly available and could be used for attacks. Upgrading to version abi-16.26 fixes this issue (patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84).

A vulnerability was identified in GPAC 26.08-DEV affecting the function gf_sg_command_del in src/scenegraph/commands.c (BIFS Handler component). The manipulation leads to a use-after-free condition, and the attack requires local access. The exploit is publicly available and might be used.

A vulnerability was determined in GPAC 26.07.0 affecting rmt_client_handle_ws_frame in src/utils/rmt_ws.c (WebSocket Handler component). Manipulating the payload_size argument can lead to a heap-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability in GPAC up to f1219cde affects the function gf_node_list_insert_child in scenegraph/base_scenegraph.c, leading to memory corruption. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version abi-16.23 is recommended to resolve the issue.

A vulnerability was detected in GPAC up to f1219cde in the function gf_node_activate_ex in scenegraph/base_scenegraph.c, leading to a stack-based buffer overflow. The attack requires local access, and the exploit is public.

A vulnerability in GPAC up to f1219cde affects the function gf_node_get_name_and_id in scenegraph/base_scenegraph.c, leading to use-after-free. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version abi-16.23 is recommended.

A vulnerability in GPAC up to f1219cde affects the function gf_url_concatenate_ex in utils/url.c, leading to a heap-based buffer overflow. The attack must be approached locally. Upgrading to version abi-16.23 is recommended to address the issue.

In GPAC up to f1219cde, a flaw in the function gf_mo_get_od_id in compositor/media_object.c of the Compositor component can lead to use-after-free. The attack can be performed remotely, and the exploit has been published. Upgrading to version abi-16.24 resolves the issue.

A heap-based buffer overflow has been detected in GPAC in the mpgviddmx_process function of filters/reframe_mpgvid.c in the MPEG Video Reframer component. The vulnerability can be exploited remotely and a public exploit is available. The issue is fixed in version abi-16.23.

A vulnerability was identified in GPAC 26.07.0 in the gf_node_deactivate_ex function of scenegraph/base_scenegraph.c in the MP4Box component. This manipulation leads to use after free. The attack must be carried out locally and the exploit is publicly available.

A vulnerability was determined in GPAC 26.07.0 in the gf_node_del function of scenegraph/base_scenegraph.c in the MP4Box component. This manipulation causes an out-of-bounds read. The attack is restricted to local execution and the exploit has been publicly disclosed.

A vulnerability was found in GPAC 26.07.0 in the gf_node_unregister function of scenegraph/base_scenegraph.c in the MP4Box component. The manipulation results in use after free. The attack is only possible with local access and the exploit has been made public.

A vulnerability has been found in GPAC 26.07.0 in the gf_sg_dom_event_bubble function of src/scenegraph/dom_events.c in the MP4Box component. The manipulation leads to a stack-based buffer overflow. The attack can only be performed from a local environment and the exploit has been disclosed to the public.

A vulnerability was found in GPAC up to f1219cde in the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the MP4Box component. Manipulation leads to use after free. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version abi-16.23 fixes the issue.

A vulnerability was found in GPAC up to f1219cde in the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the MP4Box component. Manipulation leads to use after free. The attack may be performed remotely, and the exploit has been disclosed. Upgrading to version abi-16.23 is recommended.

A flaw has been found in GPAC up to f1219cde in the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the MP4Box component. Manipulation of the argument Target causes null pointer dereference. The attack can be carried out remotely, and the exploit has been published. Upgrading to version abi-16.23 addresses the issue.

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

A vulnerability in GPAC up to f1219cde affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the MP4Box component. The manipulation causes use after free. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability in GPAC up to f1219cde affects the function gf_bt_report of the file scene_manager/loader_bt.c of the MP4Box component. The manipulation results in memory corruption. The attack may be performed remotely, and the exploit has been made public.

A vulnerability has been found in GPAC up to f1219cde in the function lsr_exec_command_list of the file laser/lsr_dec.c of the MP4Box component. The manipulation leads to a reachable assertion, and local access is required to exploit it.

A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used.

A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used.

In GPAC up to f1219cde, a vulnerability was found in the function stbl_GetSampleInfos of file isomedia/stbl_read.c in the MP4Box component. The manipulation results in a reachable assertion, the attack requires local access, and the exploit has been publicly released.

In GPAC up to f1219cde, a vulnerability was identified in the function gf_sm_dump_command_list of file scene_manager/scene_dump.c in the MP4Box component. The manipulation leads to a reachable assertion, the attack requires local access, and the exploit is publicly available.

In GPAC up to f1219cde, a vulnerability was determined in the function xmt_parse_element of file scene_manager/loader_xmt.c in the MP4Box component. The manipulation leads to a reachable assertion, the attack is restricted to local execution, and the exploit has been publicly disclosed.

In GPAC up to f1219cde, a vulnerability was found in the function gf_svg_attributes_copy of file scenegraph/svg_attributes.c in the MP4Box component. The manipulation results in a buffer over-read, the attack is only possible with local access, and the exploit has been made public.

A vulnerability was found in GPAC up to f1219cde. An unknown function in scenegraph/vrml_tools.c of the MP4Box component leads to a null pointer dereference. The attack can only be performed locally, and the exploit has been publicly disclosed.

A use-after-free flaw was found in GPAC up to f1219cde in the gf_list_count function of utils/list.c, used by the MP4Box component. The attack requires local access and a public exploit is already available. The issue is fixed in version abi-16.23 (patch 49dee5cad329cfed310c1682703df7daa47df31a).

A heap-based buffer overflow was detected in GPAC up to f1219cde in the gf_node_get_field function of scenegraph/base_scenegraph.c, used by the MP4Box component. The attack requires local access and a public exploit is already available. The issue is fixed in version abi-16.23 (patch 49dee5cad329cfed310c1682703df7daa47df31a).

A security vulnerability has been detected in GPAC up to f1219cde in the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of the MP4Box component. The manipulation leads to a null pointer dereference, and the attack can only be performed from a local environment.

A vulnerability was identified in GPAC up to f1219cde in the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the MP4Box component. The manipulation leads to a null pointer dereference, and local access is required to approach this attack.

The gf_dm_get_chunk_data function in GPAC version 26.07.0 has an out-of-bounds read that can be exploited via a crafted HTTP request, causing a denial of service. The vulnerability is fixed in a specific commit.

The gf_dm_data_received function in GPAC version 26.07.0 has an out-of-bounds read that can be exploited via a crafted HTTP request, causing a denial of service. The vulnerability is fixed in a specific commit.

The gf_dash_get_timeline_duration function in GPAC version 26.07.0 has a divide-by-zero vulnerability that can be exploited via a crafted MPD SegmentTimeline, causing a denial of service. The vulnerability is fixed in a specific commit.

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab.

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938.

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_process() function. Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859.