CVE-2024-6063: GPAC MP4Box dmx_m2ts.c m2tsdmx_on_event null pointer dereference

Published Jun 17, 2024

Updated

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmxonevent of the file src/filters/dmxm2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.

Affected Software

1 affected component

Gpac GPAC=2.5-dev-rev288-g11067ea92-master

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GPAC/MP4Box to a version that resolves this vulnerability.
Fixed in 2.5-DEV-rev228-g11067ea92-masterPatch 8767ed0a77c4b02287db3723e92c2169f67c85d5
Compensating control
Approach the attack locally as stated in the advisory (treat as a local attack scenario).

Event History

Jun 17, 2024

CVE Published

via MITRE·08:31 PM

Data Sourced

via MITRE·08:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-6063?

CVE-2024-6063 has been classified as a problematic vulnerability.

How do I fix CVE-2024-6063?

To fix CVE-2024-6063, update GPAC to the latest version that addresses this vulnerability.

What causes the CVE-2024-6063 vulnerability?

CVE-2024-6063 is caused by a null pointer dereference in the m2tsdmx_on_event function of the MP4Box component.

Which versions of GPAC are affected by CVE-2024-6063?

CVE-2024-6063 affects GPAC version 2.5-dev-rev288-g11067ea92-master.

Can CVE-2024-6063 be exploited remotely?

Exploitation of CVE-2024-6063 may require local access or specific conditions, but its details indicate it could be problematic in targeted scenarios.