CVE-2021-21838: Buffer Overflow
Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21838?
CVE-2021-21838 is considered a high severity vulnerability due to its potential to cause heap-based buffer overflows.
How do I fix CVE-2021-21838?
To fix CVE-2021-21838, update the GPAC library to version 0.5.2-426-gc5ad4e4+dfsg5-5 or later.
What types of systems are affected by CVE-2021-21838?
CVE-2021-21838 affects GPAC versions 1.0.1 and earlier installed on Debian 10.0 and Debian 11.0.
What happens if CVE-2021-21838 is exploited?
Exploitation of CVE-2021-21838 can lead to remote code execution or a denial of service through heap-based buffer overflow.
Is CVE-2021-21838 an easy vulnerability to exploit?
CVE-2021-21838 can be exploited with specially crafted MPEG-4 files, making it relatively straightforward for attackers.