CVE-2018-21015: Null Pointer Dereference
Published Sep 16, 2019
·Updated
AVCDuplicateConfig() at isomedia/avcext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. There is "cfgnew->AVCLevelIndication = cfg->AVCLevelIndication;" but cfg could be NULL.
Affected Software
2 affected components
Gpac GPAC=0.7.1
Debian Debian Linux=8.0
Event History
Sep 16, 2019
CVE Published
via MITRE·12:58 PM
Data Sourced
via MITRE·12:58 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-21015?
CVE-2018-21015 is classified as a denial of service vulnerability due to a NULL pointer dereference.
2
How do I fix CVE-2018-21015?
To fix CVE-2018-21015, upgrade GPAC to a version higher than 0.7.1.
3
Who is affected by CVE-2018-21015?
Users of GPAC version 0.7.1 and Debian Linux 8.0 are affected by CVE-2018-21015.
4
What type of attack does CVE-2018-21015 enable?
CVE-2018-21015 enables remote attackers to cause a denial of service through a crafted file.
5
What components of GPAC are involved in CVE-2018-21015?
The vulnerability is found in the AVC_DuplicateConfig() function within the isomedia/avc_ext.c file of GPAC.