VulnerabilityModified

CVE-2019-20161

There is heap-based buffer overflow in the function ReadGF_IPMPX_WatermarkingInit() in odf/ipmpx_code.c.

MEDIUM 5.5EPSS 0.90%

Does this matter?

Lower severity and a low EPSS score (0.90%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function ReadGF_IPMPX_WatermarkingInit() in odf/ipmpx_code.c.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.90% probability · 58th percentile
CISA KEV: Not listed
Weakness: CWE-787
Affected: gpac/gpac · debian/debian linux
Source: cve@mitre.org

References

https://github.com/gpac/gpac/issues/1320Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00017.htmlMailing List, Third Party Advisory
https://github.com/gpac/gpac/issues/1320Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00017.htmlMailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.