CVE-2020-11558: Use After Free

Published Apr 5, 2020

Updated

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audiosampleentryRead in isomedia/boxcodebase.c does not properly decide when to make gfisomboxdel calls. This leads to various use-after-free outcomes involving mdiaRead, gfisomdeletemovie, and gfisomparsemovieboxes.

Affected Software

1 affected component

Gpac GPAC=0.8.0

Remediation

Patch Available

https://github.com/gpac/gpac/commit/6063b1a011c3f80cee25daade18154e15e4c058c

Event History

Apr 5, 2020

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-11558?

The severity of CVE-2020-11558 is categorized as high due to the potential for remote code execution and use-after-free vulnerabilities.

How do I fix CVE-2020-11558?

To fix CVE-2020-11558, upgrade GPAC to the latest version that addresses this vulnerability.

What versions of GPAC are affected by CVE-2020-11558?

CVE-2020-11558 affects GPAC version 0.8.0 specifically.

What kind of vulnerability is CVE-2020-11558?

CVE-2020-11558 is a use-after-free vulnerability found in the audio_sample_entry_Read function.

Can CVE-2020-11558 lead to data corruption?

Yes, CVE-2020-11558 could potentially lead to data corruption due to improper memory handling.