CVE-2024-6063

NameCVE-2024-6063
DescriptionA vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1074414

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gpac (PTS)bullseye (security), bullseye1.0.1+dfsg1-4+deb11u3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gpacsourcebuster(unfixed)end-of-life
gpacsourcebullseye(unfixed)end-of-life
gpacsource(unstable)(unfixed)1074414

Notes

[bullseye] - gpac <end-of-life> (EOL in bullseye LTS)
[buster] - gpac <end-of-life> (EOL in buster LTS)
https://github.com/gpac/gpac/issues/2873
https://github.com/gpac/gpac/commit/8767ed0a77c4b02287db3723e92c2169f67c85d5

Search for package or bug name: Reporting problems