Summary
It was discovered that the GPAC MP4Box utility incorrectly handled certain
AC3 files, which could lead to an out-of-bounds read. A remote attacker
could use this issue to cause MP4Box to crash, resulting in a denial of
service (system crash). This issue only affected Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2023-5520, CVE-2024-0322)
It was discovered that the GPAC MP4Box utility incorrectly handled certain
malformed text files. If a user or automated system using MP4Box were
tricked into opening a specially crafted RST file, an attacker could use
this issue to cause a denial of service (system crash) or execute arbitrary
code. (CVE-2024-0321)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | gpac | 0.5.0+svn4288~dfsg1-4ubuntu1+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gpac | 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gpac | 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gpac | 0.5.2-426-gc5ad4e4+dfsg5-5ubuntu0.1~esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | gpac | 2.0.0+dfsg1-2ubuntu0.1~esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | gpac | 2.2.1+dfsg1-3.1ubuntu0.1~esm2 |
Vulnerabilities 3
-
Medium 4.4
Out-of-bounds Read in gpac/gpac
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
-
Medium 4.0
Out-of-bounds Read in gpac/gpac
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
-
Medium 4.0
Stack-based Buffer Overflow in gpac/gpac
Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.