GPAC Security Vulnerabilities

CVE-2024-6064

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end of the file src/scene_manager/loader_xmt.c of the component MP4Box. The manipulation leads to use after free. Local access is required to...

CVE-2024-6063

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached...

CVE-2024-6062

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be...

CVE-2024-6061

A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch...

CVE-2024-24266

gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at...

CVE-2024-24265

gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal...

CVE-2024-24267

gpac v2.2.1 was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob...

CVE-2024-22749

GPAC v2.3 was detected to contain a buffer overflow via the function gf_isom_new_generic_sample_description function in the...

CVE-2023-50120

MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4...

CVE-2024-0321

Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to...

CVE-2024-0322

Out-of-bounds Read in GitHub repository gpac/gpac prior to...

CVE-2023-46929

An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the...

CVE-2023-46932

Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (DoS) via str2ulong class in src/media_tools/avilib.c in...

CVE-2023-47465

An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file...

CVE-2023-46871

GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a denial of...

CVE-2023-48958

gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url...

CVE-2023-48090

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes...

CVE-2023-48039

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string...

CVE-2023-48014

GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at...

CVE-2023-48011

GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at...

CVE-2023-48013

GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at...

CVE-2023-47384

MP4Box GPAC v2.3-DEV-rev617-g671976fcc-master was discovered to contain a memory leak in the function gf_isom_add_chapter at /isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4...

CVE-2023-46001

Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isom_read.c:2807:51 function in...

CVE-2023-5998

Out-of-bounds Read in GitHub repository gpac/gpac prior to...

CVE-2023-46927

GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in...

CVE-2023-46928

GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl...

CVE-2023-46931

GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in...

CVE-2023-46930

GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track...

CVE-2023-5595

Denial of Service in GitHub repository gpac/gpac prior to...

CVE-2023-5586

NULL Pointer Dereference in GitHub repository gpac/gpac prior to...

CVE-2023-42298

An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file...

CVE-2023-5520

Out-of-bounds Read in GitHub repository gpac/gpac prior to...

CVE-2023-5377

Out-of-bounds Read in GitHub repository gpac/gpac prior to...

CVE-2023-41000

GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in...

CVE-2023-4778

Out-of-bounds Read in GitHub repository gpac/gpac prior to...

CVE-2023-4758

Buffer Over-read in GitHub repository gpac/gpac prior to...

CVE-2023-4755

Use After Free in GitHub repository gpac/gpac prior to...

CVE-2023-4754

Out-of-bounds Write in GitHub repository gpac/gpac prior to...

CVE-2023-4756

Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to...

CVE-2023-4721

Out-of-bounds Read in GitHub repository gpac/gpac prior to...

CVE-2023-4720

Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to...

CVE-2023-4722

Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to...

CVE-2023-4683

NULL Pointer Dereference in GitHub repository gpac/gpac prior to...

CVE-2023-4682

Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to...

CVE-2023-4678

Divide By Zero in GitHub repository gpac/gpac prior to...

CVE-2023-4681

NULL Pointer Dereference in GitHub repository gpac/gpac prior to...

CVE-2023-39562

GPAC v2.3-DEV-rev449-g5948e4f70-master was discovered to contain a heap-use-after-free via the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted...

CVE-2023-37767

GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the BM_ParseIndexValueReplace function at...

CVE-2023-37765

GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_dump_vrml_sffield function at...

CVE-2023-37174

GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at...