| Name | CVE-2022-30976 |
| Description | GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-read, as demonstrated by MP4Box. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1016443 |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| gpac | source | stretch | (unfixed) | end-of-life | ||
| gpac | source | buster | (unfixed) | end-of-life | ||
| gpac | source | (unstable) | 2.0.0+dfsg1-4 | 1016443 |
[bullseye] - gpac <ignored> (Minor issue)
[buster] - gpac <end-of-life> (EOL in buster LTS)
[stretch] - gpac <end-of-life> (No longer supported in LTS)
https://github.com/gpac/gpac/issues/2179
https://github.com/gpac/gpac/commit/915e2cba715f36b7cc29e28888117831ca143d78
When fixing this issue make sure to as well apply (cf. CVE-2022-3178)
https://github.com/gpac/gpac/commit/77510778516803b7f7402d7423c6d6bef50254c3
to not open that issue.