CVE-2018-20763
Published: 6 February 2019
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
From the Ubuntu Security Team
It was discovered that the GPAC MP4Box utility incorrectly handled certain memory operations. If an user or automated system were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause MP4Box to crash, resulting in a denial of service, or possibly execute arbitrary code.
Priority
Status
Package | Release | Status |
---|---|---|
gpac Launchpad, Ubuntu, Debian |
hirsute |
Not vulnerable
(0.5.2-426-gc5ad4e4+dfsg5-5)
|
bionic |
Released
(0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1)
|
|
cosmic |
Released
(0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Ignored
(end of life)
|
|
focal |
Not vulnerable
(0.5.2-426-gc5ad4e4+dfsg5-5)
|
|
groovy |
Not vulnerable
(0.5.2-426-gc5ad4e4+dfsg5-5)
|
|
impish |
Not vulnerable
(0.5.2-426-gc5ad4e4+dfsg5-5)
|
|
jammy |
Not vulnerable
(0.5.2-426-gc5ad4e4+dfsg5-5)
|
|
upstream |
Needs triage
|
|
xenial |
Released
(0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1)
|
|
trusty |
Released
(0.5.0+svn4288~dfsg1-4ubuntu1+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.8 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |