Out-of-bounds Read Affecting gpac package, versions <1.0.1+dfsg1-4+deb11u2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-GPAC-2803425
- published 26 Apr 2022
- disclosed 25 Apr 2022
Introduced: 25 Apr 2022
CVE-2022-1441 Open this link in a new tabHow to fix?
Upgrade Debian:11 gpac to version 1.0.1+dfsg1-4+deb11u2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream gpac package and not the gpac package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function diST_box_read() to read from video. In this function, it allocates a buffer str with fixed length. However, content read from bs is controllable by user, so is the length, which causes a buffer overflow.