Description
A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elng_box_read of the file src/isomedia/box_code_base.c of the component MP4Box. Performing a manipulation of the argument elng results in out-of-bounds read. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is named cf6ac48c972eaaee2af270adc3f36615325deb3e. The affected component should be upgraded.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GPAC | 26.03-DEV-rev105-g8f39a1eb3-master | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | gpac | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 22.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gpac | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 16.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gpac | No fix yet | — |
References
- VDB-359734 | GPAC MP4Box box_code_base.c elng_box_read out-of-bounds vdb-entry technical-description
- VDB-359734 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #800985 | gpac laster Memory Corruption third-party-advisory
- https://github.com/gpac/gpac/issues/3516 exploit issue-tracking
- https://github.com/gpac/gpac/commit/cf6ac48c972eaaee2af270adc3f36615325deb3e patch
- https://github.com/gpac/gpac/releases/tag/abi-16.8 patch
- https://github.com/gpac/gpac/ product