VulnerabilityModified

CVE-2019-20162

There is heap-based buffer overflow in the function gf_isom_box_parse_ex() in isomedia/box_funcs.c.

MEDIUM 5.5EPSS 0.90%

Does this matter?

Lower severity and a low EPSS score (0.90%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function gf_isom_box_parse_ex() in isomedia/box_funcs.c.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.90% probability · 58th percentile
CISA KEV: Not listed
Weakness: CWE-787
Affected: gpac/gpac · debian/debian linux
Source: cve@mitre.org

References

https://github.com/gpac/gpac/issues/1327Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00017.htmlMailing List, Third Party Advisory
https://github.com/gpac/gpac/issues/1327Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00017.htmlMailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.