NULL Pointer Dereference Affecting gpac package, versions <1.0.1+dfsg1-4+deb11u2
Threat Intelligence
EPSS
0.14% (50th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-GPAC-2422606
- published 15 Mar 2022
- disclosed 14 Mar 2022
Introduced: 14 Mar 2022
CVE-2022-24577 Open this link in a new tabHow to fix?
Upgrade Debian:11 gpac to version 1.0.1+dfsg1-4+deb11u2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream gpac package and not the gpac package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen. (gf_utf8_wcslen is a renamed Unicode utf8_wcslen function.)
References
- https://security-tracker.debian.org/tracker/CVE-2022-24577
- https://github.com/gpac/gpac/blob/105d67985ff3c3f4b98a98f312e3d84ae77a4463/share/doc/man/gpac.1#L2226-L2229
- https://github.com/gpac/gpac/blob/105d67985ff3c3f4b98a98f312e3d84ae77a4463/src/utils/utf.c#L35-L59
- https://huntr.dev/bounties/0758b3a2-8ff2-45fc-8543-7633d605d24e/
- https://www.debian.org/security/2023/dsa-5411
CVSS Scores
version 3.1