GPAC MP4Box v2.4 vulnerabilities

A use-after-free vulnerability was found in the gf_filter_pid_inst_swap function of GPAC/MP4Box before version 26.02.0. An attacker can supply a crafted media file to cause a Denial of Service (DoS).

A use-after-free vulnerability was found in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted MPEG-2 TS file.

A NULL pointer dereference vulnerability was found in the gf_filter_in_parent_chain function of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted file.

A use-after-free vulnerability was found in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted media file.

A buffer overflow vulnerability in the gf_media_import function of GPAC/MP4Box before version 26.02.0 allows an attacker to cause a Denial of Service (DoS) by supplying a crafted input file.

A NULL pointer dereference vulnerability was discovered in GPAC MP4Box v2.4 in the gf_isom_add_track_kind() function at isomedia/isom_write.c. Attackers can exploit this by crafting a malicious MP4 file to cause a Denial of Service (DoS).

A segmentation violation in the Track_SetStreamDescriptor function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A stack overflow in the gf_opus_read_length function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

A heap buffer overflow in the gf_isom_vp_config_new function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

A heap use-after-free vulnerability in the gf_node_get_tag function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

A NULL pointer dereference in the gf_media_map_esd function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

A heap buffer overflow in the gf_opus_parse_packet_header function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

The mp4_mux_cenc_insert_pssh function in GPAC MP4Box v2.4 has an Out-of-Memory error that allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

A heap buffer overflow in the gf_cenc_set_pssh function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

A heap use-after-free vulnerability in the gf_node_get_tag function of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

In version 2.4 of GPAC MP4Box, a floating point exception was discovered in the avidmx_process function (isomedia/isom_write.c).

A NULL pointer dereference in the gf_isom_copy_sample_info function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.

GPAC MP4Box v2.4 has a NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c). Attackers can cause a Denial of Service (DoS) by supplying a crafted MP4 file.

Stack buffer overflow vulnerability in the filein_process function (in_file.c) of GPAC MP4Box v2.4. An attacker can cause a Denial of Service (DoS) by supplying a crafted MP4 file.

In GPAC Project/MP4Box before version 26.02.0, a NULL pointer dereference exists in the gf_filter_pid_resolve_file_template_ex function in /filter_core/filter_pid.c. An attacker can supply a crafted file to cause a Denial of Service (DoS).

A heap buffer overflow in the m2tsdmx_send_packet function of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.