CVE-2021-21860: Buffer Overflow

Published Aug 16, 2021

Updated

An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an improper memory allocation resulting in a heap-based buffer overflow that causes memory corruption. The FOURCC code, 'trik', is parsed by the function within the library. An attacker can convince a user to open a video to trigger this vulnerability.

Affected Software

3 affected componentsFixes available

debian/gpac

0.5.2-426-gc5ad4e4+dfsg5-51.0.1+dfsg1-4+deb11u32.2.1+dfsg1-3

Gpac GPAC=1.0.1

Debian Debian Linux=11.0

Event History

Aug 16, 2021

CVE Published

via MITRE·07:07 PM

Data Sourced

via MITRE·07:07 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-21860?

CVE-2021-21860 is considered a high severity vulnerability due to the potential for a heap-based buffer overflow and subsequent memory corruption.

How do I fix CVE-2021-21860?

To fix CVE-2021-21860, upgrade to GPAC version 0.5.2-426-gc5ad4e4+dfsg5-5 or later versions recommended in the Debian security advisory.

What software is affected by CVE-2021-21860?

CVE-2021-21860 affects GPAC version 1.0.1 and is also found in specific Debian Linux distributions.

What type of vulnerability is CVE-2021-21860?

CVE-2021-21860 is an integer truncation vulnerability that can lead to heap-based buffer overflow during MPEG-4 decoding.

Can CVE-2021-21860 be exploited remotely?

Yes, CVE-2021-21860 can be exploited remotely by sending specially crafted MPEG-4 files to the affected system.