CVE-2023-1449: GPAC av_parsers.c gf_av1_reset_state double free
First published: Fri Mar 17 2023(Updated: )
A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gf_av1_reset_state of the file media_tools/av_parsers.c. The manipulation leads to double free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223294 is the identifier assigned to this vulnerability.
Credit: cna@vuldb.com cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/gpac | <=0.5.2-426-gc5ad4e4+dfsg5-5 | 1.0.1+dfsg1-4+deb11u3 2.2.1+dfsg1-3 |
| GPAC GPAC | =2.3-dev | |
| =2.3-dev |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://vuldb.com/?id.223294
- https://vuldb.com/?ctiid.223294
- https://github.com/gpac/gpac/issues/2387
- https://github.com/xxy1126/Vuln/blob/main/gpac/2
- https://github.com/gpac/gpac/commit/8ebbfd61c73d61a2913721a492e5a81fb8d9f9a9
- https://github.com/gpac/gpac/commit/7c07b1346d64354ba3ac6412097cce1db119eef0
- https://security-tracker.debian.org/tracker/CVE-2023-1449
- https://www.debian.org/security/2023/dsa-5411
Frequently Asked Questions
What is CVE-2023-1449?
CVE-2023-1449 is a vulnerability found in GPAC 2.3-DEV-rev35-gbbca86917-master that affects the gf_av1_reset_state function in the file media_tools/av_parsers.c, leading to a double free vulnerability.
What is the severity of CVE-2023-1449?
CVE-2023-1449 has a severity rating of 7.8 (high).
How does CVE-2023-1449 affect the local host?
CVE-2023-1449 allows for the launch of an attack on the local host.
Which software versions are affected by CVE-2023-1449?
CVE-2023-1449 affects GPAC versions 2.3-DEV-rev35-gbbca86917-master and 2.3-dev, as well as Debian versions 1.0.1+dfsg1-4+deb11u3 and 2.2.1+dfsg1-3.
How can I fix CVE-2023-1449?
To fix CVE-2023-1449, update GPAC to version 2.3-DEV-rev35-gbbca86917-master or apply the Debian patches 1.0.1+dfsg1-4+deb11u3 and 2.2.1+dfsg1-3 to the affected versions.
- collector/security-tracker-debian
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- agent/severity
- agent/remedy
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/gpac
- canonical/gpac gpac
- version/gpac gpac/2.3-dev