CVE-2018-1000100: Buffer Overflow
First published: Tue Mar 06 2018(Updated: )
GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks being modified, this could lead to RCE. This attack appear to be exploitable via an attacker supplied MP4 file that when run by the victim may result in RCE.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/gpac | 1.0.1+dfsg1-4+deb11u3 | |
| GPAC | <=0.7.1 | |
| Ubuntu Linux | =16.04 | |
| Ubuntu Linux | =18.04 | |
| Ubuntu Linux | =18.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/gpac/gpac/issues/994
- https://usn.ubuntu.com/3926-1/
- https://launchpad.net/bugs/cve/CVE-2018-1000100
- https://github.com/gpac/gpac/commit/90dc7f853d31b0a4e9441cba97feccf36d8b69a4
- https://security-tracker.debian.org/tracker/CVE-2018-1000100
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000100
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000100
- https://ubuntu.com/security/CVE-2018-1000100
Frequently Asked Questions
What is the severity of CVE-2018-1000100?
CVE-2018-1000100 is considered a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2018-1000100?
To fix CVE-2018-1000100, upgrade GPAC to version 1.0.1+dfsg1-4+deb11u3 or later.
What software versions are affected by CVE-2018-1000100?
CVE-2018-1000100 affects GPAC versions 0.7.1 and earlier.
Can CVE-2018-1000100 be exploited remotely?
Yes, CVE-2018-1000100 can be exploited remotely via a malicious MP4 file supplied by an attacker.
What type of vulnerability is CVE-2018-1000100?
CVE-2018-1000100 is a buffer overflow vulnerability that can lead to heap memory modification.
- agent/author
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/severity
- agent/remedy
- agent/weakness
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/debian
- vendor/gpac project
- canonical/gpac
- version/gpac/0.7.1
- vendor/canonical
- canonical/ubuntu linux
- version/ubuntu linux/16.04
- version/ubuntu linux/18.04
- version/ubuntu linux/18.10