Debian update for gpac



| Updated: 2022-12-22
Risk High
Patch available YES
Number of vulnerabilities 24
CVE-ID CVE-2021-21834
CVE-2021-21848
CVE-2021-21861
CVE-2021-21860
CVE-2021-21859
CVE-2021-21858
CVE-2021-21857
CVE-2021-21855
CVE-2021-21854
CVE-2021-21853
CVE-2021-21850
CVE-2021-21849
CVE-2021-21847
CVE-2021-21836
CVE-2021-21846
CVE-2021-21845
CVE-2021-21844
CVE-2021-21843
CVE-2021-21842
CVE-2021-21841
CVE-2021-21840
CVE-2021-21839
CVE-2021-21838
CVE-2021-21837
CWE-ID CWE-190
Exploitation vector Network
Public exploit N/A
Vulnerable software
 gpac (Debian package)
Operating systems & Components / Operating system package or component

Vendor Debian

Security Bulletin

This security bulletin contains information about 24 vulnerabilities.

1) Integer overflow

EUVDB-ID: #VU55886

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21834

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "co64" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU55900

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21848

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stz2” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU55878

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21861

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "hdlr" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Integer overflow

EUVDB-ID: #VU55877

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21860

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "trik" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Integer overflow

EUVDB-ID: #VU55876

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21859

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stri" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU55885

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21858

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "url" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Integer overflow

EUVDB-ID: #VU55884

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21857

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "txtc" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Integer overflow

EUVDB-ID: #VU55882

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21855

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "sdp" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Integer overflow

EUVDB-ID: #VU55881

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21854

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "rtp" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Integer overflow

EUVDB-ID: #VU55880

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21853

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "name" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Integer overflow

EUVDB-ID: #VU55902

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21850

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "trun” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Integer overflow

EUVDB-ID: #VU55901

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21849

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "tfra” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Integer overflow

EUVDB-ID: #VU55905

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21847

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "“stts” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Integer overflow

EUVDB-ID: #VU55888

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21836

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "ctts" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Integer overflow

EUVDB-ID: #VU55898

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21846

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stsz” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Integer overflow

EUVDB-ID: #VU55897

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21845

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stsc” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Integer overflow

EUVDB-ID: #VU55896

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21844

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stco” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Integer overflow

EUVDB-ID: #VU55895

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21843

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "ssix” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Integer overflow

EUVDB-ID: #VU55894

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21842

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "ssix” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Integer overflow

EUVDB-ID: #VU55893

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21841

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "sbgp” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Integer overflow

EUVDB-ID: #VU55892

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21840

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "saio" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Integer overflow

EUVDB-ID: #VU55891

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21839

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "pcrb" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Integer overflow

EUVDB-ID: #VU55890

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21838

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "fpar" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Integer overflow

EUVDB-ID: #VU55889

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21837

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "fecr" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

CPE2.3 External links

https://www.debian.org/security/2021/dsa-4966


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###