CVE-2018-7752

NameCVE-2018-7752
DescriptionGPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1693-1
NVD severitymedium (attack range: remote)
Debian Bugs892526

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gpac (PTS)jessie0.5.0+svn5324~dfsg1-1vulnerable
jessie (security)0.5.0+svn5324~dfsg1-1+deb8u3fixed
stretch0.5.2-426-gc5ad4e4+dfsg5-3+deb9u1fixed
buster (security)0.5.2-426-gc5ad4e4+dfsg5-5~deb10u1fixed
buster, sid0.5.2-426-gc5ad4e4+dfsg5-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gpacsource(unstable)0.5.2-426-gc5ad4e4+dfsg5-4.1medium892526
gpacsourcejessie0.5.0+svn5324~dfsg1-1+deb8u2mediumDLA-1693-1
gpacsourcestretch0.5.2-426-gc5ad4e4+dfsg5-3+deb9u1medium
gpacsourcewheezy(not affected)

Notes

[wheezy] - gpac <not-affected> (vulnerable code not present)
https://github.com/gpac/gpac/issues/997
https://github.com/gpac/gpac/commit/90dc7f853d31b0a4e9441cba97feccf36d8b69a4
CVE is for the issue in av_parsers.c and fixed in same commit as
CVE-2018-1000100

Search for package or bug name: Reporting problems