Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function

A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsubreadidx of the file /src/mediatools/vobsub.c of the component MP4Box. Executing a manipulation of the argument numlangs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.

A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpddelentry of the file src/isomedia/boxcodebase.c of the component MP4Box. Such manipulation of the argument data leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is f29f955f2a3b5e8e507caad3e52319f961bf37bf. It is advisable to implement a patch to correct this issue.

A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gfisomnalusamplerewrite of the file src/isomedia/avcext.c of the component MP4Box. This manipulation of the argument naluoutbs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.

A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtinprobeduration of the file src/filters/loadtext.c of the component TeXML File Handler. Such manipulation of the argument txmltimescale leads to divide by zero. An attack has to be approached locally. The name of the patch is 86a5191f2e750c767253e27ed6cfd6d547afebc2. A patch should be applied to remediate this issue.

A flaw has been found in GPAC 26.02.0. This affects the function nhmldumpsendframe of the file src/filters/writenhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be used. This patch is called bd1d94e70e3bef364c07c5a1d94eca5c9f56e160. A patch should be applied to remediate this issue. The project explains: "I would consider most of these more as bugs than vulns but anyway they're good to fix".

A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/baseencoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60474 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gfmediaimport() function in GPAC's media import layer (mediatools/mediaimport.c:1297) imports media tracks from input files into the filter processing pipeline. When MP4Box inspects a crafted MPEG-2 TS file, the function stores a property value that was produced by strdup(""), allocating a 1-byte heap buffer containing only the NUL terminator at address 0x502000003110.

The function subsequently reads 1 byte at offset [1] of this buffer (past its only valid index [0]) at address 0x502000003111, triggering a heap-buffer-overflow read and crashing the process (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 38gfmediaimportmediatoolsmediaimportc1297

Asan-log: ==2016054==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003111 at pc 0x7f11ecdaca1e bp 0x7fffd1145a00 sp 0x7fffd11459f8 READ of size 1 at 0x502000003111 thread T0 #0 0x7f11ecdaca1d in gfmediaimport mediatools/mediaimport.c:1297 #1 0x558a953c08e3 in convertfileinfo /media/user/8b16fbb8-17fc-4a2a-99f7-d4da627d0251/gpacasan/applications/mp4box/fileimport.c:131 #2 0x558a953914b7 in mp4boxmain /media/user/8b16fbb8-17fc-4a2a-99f7-d4da627d0251/gpacasan/applications/mp4box/mp4box.c:6520

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/38/38gfmediaimportmediatoolsmediaimportc1297

References: https://github.com/gpac/gpac/issues/3287 https://www.cve.org/CVERecord?id=CVE-2025-60474 https://infosec.exchange/@sigdevel/116780566799952592

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60473 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterinparentchain() function in GPAC's filter session core (filtercore/filterpid.c:2145) walks the filter parent chain to determine whether a given filter is an ancestor of another, and is called during PID initialization from gffilterpidinittask(). When MP4Box inspects a crafted MPEG-2 TS file containing corrupted PMT descriptors, reused PIDs, and malformed PES headers that produce an abnormal PID chain state, the function is reached with a NULL or uninitialized parent filter pointer.

The function dereferences the parent pointer without validating it, attempting a READ at address 0x000000000008 (null+0x8 field offset), resulting in a segmentation fault and process crash (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 36gffilterinparentchainfiltercorefilterpidc2145

Asan-log: ==2015443==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7f7ec2e52c65 bp 0x519000016d80 sp 0x7fffe9ee7390 T0) ==2015443==The signal is caused by a READ memory access. #0 0x7f7ec2e52c65 in gffilterinparentchain filtercore/filterpid.c:2145 #1 0x7f7ec2e7a796 in gffilterpidinittask filtercore/filterpid.c:4932 #2 0x7f7ec2ec3465 in gffsthreadproc filtercore/filtersession.c:2420

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/36gffilterinparentchainfiltercorefilterpidc2145

References: https://github.com/gpac/gpac/issues/3285 https://www.cve.org/CVERecord?id=CVE-2025-60473 https://infosec.exchange/@sigdevel/116780471059317580

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60466 CWE: CWE-825 (Expired Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterpidgetpacket() function in GPAC's filter session core (filtercore/filterpid.c:6827) retrieves the next available packet from a filter PID for processing by downstream filters such as the inspect filter. When MP4Box inspects a crafted MPEG-2 TS file with corrupted PMT descriptors and abnormal PCR discontinuities that drive the pipeline through PID deletion and re-enqueue paths, gffilterpiddel() frees the 336-byte PID instance at filtercore/filterpid.c:5933.

The inspect filter subsequently calls gffilterpidgetpacket() on the invalidated PID without checking whether the PID object has been released, performing a READ of 8 bytes at address 0x513000002dc0 (start of the freed allocation) and crashing the process (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 35gffilterpidgetpacketfiltercorefilterpidc6827

Asan-log: ==1994506==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000002dc0 at pc 0x7fdaa268b8b7 bp 0x7fff42a43b80 sp 0x7fff42a43b78 READ of size 8 at 0x513000002dc0 thread T0 #0 0x7fdaa268b8b6 in gffilterpidgetpacket filtercore/filterpid.c:6827 #1 0x7fdaa2906374 in inspectprocess filters/inspect.c:5218 #2 0x7fdaa26ef401 in gffilterprocesstask filtercore/filter.c:3180

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/35/35gffilterpidgetpacketfiltercorefilterpidc6827

References: https://github.com/gpac/gpac/issues/3284 https://www.cve.org/CVERecord?id=CVE-2025-60466 https://infosec.exchange/@sigdevel/116780402249845037

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60465 CWE: CWE-416 (Use After Free) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterpidinstswap() function in GPAC's filter session core (filtercore/filterpid.c:633) swaps PID instance references during PID reconfiguration. When MP4Box inspects a crafted MPEG-2 TS file containing corrupted PMT descriptors and invalid stream configurations, the function frees the ctx->pidinst structure (a 336-byte allocation) at filtercore/filterpid.c:716 inside gffilterpidconfigure() but does not reset the pointer to NULL afterwards.

A subsequent code path within the same reconfiguration call dereferences the now-dangling ctx->pidinst pointer, performing a READ of 8 bytes at address 0x513000000598 (24 bytes inside the freed region), resulting in a heap-use-after-free and process crash (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 34gffilterpidinstswapfiltercorefilterpidc633

Asan-log: ==1992184==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000598 at pc 0x7f2c95a88277 bp 0x7ffd4ffcb9e0 sp 0x7ffd4ffcb9d8 READ of size 8 at 0x513000000598 thread T0 #0 0x7f2c95a88276 in gffilterpidinstswap filtercore/filterpid.c:633 #1 0x7f2c95a88276 in gffilterpidconfigure filtercore/filterpid.c:919 #2 0x7f2c95a89a22 in gffilterpidconnecttask filtercore/filterpid.c:1311

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/34/34gffilterpidinstswapfiltercorefilterpidc633

References: https://github.com/gpac/gpac/issues/3283 https://www.cve.org/CVERecord?id=CVE-2025-60465 https://infosec.exchange/@sigdevel/116778494176930561

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 62714f27c64a3d1eb7e880f9eed2d38673cb43ce CVE: CVE-2025-60464 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gfseiloadfromstateinternal() function in GPAC's SEI loader (filters/seiload.c:225) processes Supplemental Enhancement Information payloads embedded in HEVC and VVC bitstreams transported over MPEG-2 TS. When MP4Box inspects a crafted TS file containing HEVC/VVC streams with malformed NAL units and corrupted PMT descriptors, the NALU demuxer naludmxconfigurepid() frees the codec state buffer at filters/reframenalu.c:370 during PID reconfiguration.

The function subsequently reads 1 byte from the freed 529,176-byte codec state region at address 0x7f7518dceb04 (529,156 bytes inside the freed allocation) without validating whether the buffer has been released, resulting in a heap-use-after-free and process crash (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 32filtersseiloadc225ingfseiloadfromstateinternal

Asan-log: ==33468==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f7518dceb04 at pc 0x7f751b19dbf5 bp 0x7ffc77f69500 sp 0x7ffc77f694f8 READ of size 1 at 0x7f7518dceb04 thread T0 #0 0x7f751b19dbf4 in gfseiloadfromstateinternal filters/seiload.c:225 #1 0x7f751b19dbf4 in gfseiloadfromstate filters/seiload.c:265 #2 0x7f751b0ffd02 in naludmxfinalizeauflags filters/reframenalu.c:2360

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/32/32filtersseiloadc225ingfseiloadfromstateinternal

References: https://github.com/gpac/gpac/issues/3278 https://www.cve.org/CVERecord?id=CVE-2025-60464 https://infosec.exchange/@sigdevel/116778370895014131

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 62714f27c64a3d1eb7e880f9eed2d38673cb43ce CVE: CVE-2025-60471 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterpidreconfiguretaskdiscard() function in GPAC's filter session core (filtercore/filterpid.c:1341) handles cleanup of filter PID reconfiguration tasks during media import. When MP4Box processes a crafted MPEG-2 TS file containing corrupted PMT descriptors and invalid packet streams, the filter session schedules a PID reconfiguration that triggers deallocation of a pidinst structure via gffilterpidinstswapdelete() in filtercore/filterpid.c:540.

The function subsequently accesses the already-freed 336-byte pidinst region at address 0x513000000580 without validating whether the instance has been released, resulting in a heap-use-after-free on a READ of 8 bytes at that address and potential arbitrary code execution.

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 31gffilterpidreconfiguretaskdiscardfiltercorefilterpidc1341

Asan-log: ==26772==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000580 at pc 0x7fe607a8b95d bp 0x7fff9793a4b0 sp 0x7fff9793a4a8 READ of size 8 at 0x513000000580 thread T0 #0 0x7fe607a8b95c in gffilterpidreconfiguretaskdiscard filtercore/filterpid.c:1341 #1 0x7fe607ac2f65 in gffsthreadproc filtercore/filtersession.c:2420 #2 0x7fe607ac81c4 in gffsrun filtercore/filtersession.c:2727

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/31/31gffilterpidreconfiguretaskdiscardfiltercorefilterpidc1341

References: https://github.com/gpac/gpac/issues/3279 https://www.cve.org/CVERecord?id=CVE-2025-60471 https://infosec.exchange/@sigdevel/116778301425195980

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 78c2c9be29a41b38eca2c53d280442088a71dab9 CVE: CVE-2025-55639 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gfisomaddtrackkind() function in GPAC's ISO media muxer (isomedia/isomwrite.c:3153) appends a track "kind" metadata entry to an MP4 track during mux setup. When MP4Box imports a crafted MP4 file containing corrupted MPEG-2 TS PMT descriptors and an MPEG-H Audio track with missing or empty kind metadata, mp4muxsetudta() in filters/muxisom.c:938 passes a NULL pointer as the kind argument to gfisomaddtrackkind().

The function does not validate the kind pointer before passing it to strdup(), which internally calls strlen() on address 0x0, triggering a segmentation fault and crashing the process (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: ./configure --enable-sanitizer && make ; -Command: ./MP4Box -add 23poc.mp4 -new /dev/null

Asan-log: ==748312==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8d4d70efe6 bp 0x7ffc18a95310 sp 0x7ffc18a94ab8 T0) ==748312==The signal is caused by a READ memory access. #0 0x7f8d4d70efe6 in sanitizer::internalstrlen(char const) ../../../../src/libsanitizer/sanitizercommon/sanitizerlibc.cpp:176 #1 0x7f8d4d6eeba9 in strdup ../../../../src/libsanitizer/asan/asaninterceptors.cpp:574 #2 0x7f8d4bfffe94 in gfisomaddtrackkind isomedia/isomwrite.c:3153

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/23/23poc.mp4

References: https://github.com/gpac/gpac/issues/3260 https://www.cve.org/CVERecord?id=CVE-2025-55639 https://infosec.exchange/@sigdevel/116769184815236865

—— Best regards, Alexander A. Shvedov @sigdevel

A use-after-free in the gfseiloadfromstateinternal function (/filters/seiload.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.

A use-after-free in the gffilterpidinstswap function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A use-after-free in the gffilterpidreconfiguretaskdiscard function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filtercore/filterpid.c (L:574-580): function gffilterpidinstswapdeletetask() improperly accesses freed objects during PID instance swap/delete cleanup, leading to heap use-after-free. The attack vector is: Local (AV:L): a local, authenticated user who processes a specially crafted MPEG-2 TS/MP4 file with MP4Box can trigger the bug during filter teardown (PID instance swap/delete), causing a crash. ¶¶ In GPAC s MP4Box, gffilterpidinstswapdeletetask() in filtercore/filterpid.c may dereference objects after they have been freed when cleaning up PID instances after a swap/delete operation. Crafted inputs (e.g., malformed MPEG-2 TS) can trigger a heap use-after-free and crash; exploitation may be possible.

A use-after-free in the gffilterpidinstswapdeletetask function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A buffer overflow in the gfmediaimport function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

A use-after-free in the gffilterpidgetpacket function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A NULL pointer dereference in the gffilterinparentchain function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gfisomaddtrackkind() function at isomedia/isomwrite.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

A heap buffer overflow in the gfcencsetpssh function (isomedia/drmsample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A NULL pointer dereference in the TrackWriter handling component (filters/muxisom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Hi David,

On Mon, Jun 08, 2026 at 07:46:07PM -0400, David A. Wheeler wrote: All: I propose that we create a separate mailing list, say "oss-security-vulnerability-reports", for run-of-the-mill vulnerability reports about open source software (OSS). Run-of-the-mill reports would then go there and not to this mailing list "oss-security". This would leave this oss-security" mailing list for general discussions about the topic of OSS security, including discussions about specific publicly known vulnerabilities that are especially noteworthy in some way. Tools that want the full flood could monitor "oss-security-vulnerability-reports".

Here's my rationale.

In short: There are so many OSS projects that it's already dubious to have a single mailing list for OSS vulnerability reports. However, I believe the coming AI vulnpocalypse will make it completely absurd. If we don't do this, I think the human participants will need to unsubscribe from this list sooner or later, and that would be sad. Thank you for bringing this up.

I do indeed see the problem, but I don't like the proposal. Also, for now the increased volume on this list hasn't exceeded its historical pre-AI peak: we had 485 messages in October 2014, but 455 in May 2026. I'm not seeing a mass exodus of subscribers either. There's greater churn - more people are leaving, but at the same time more are joining.

Just by saying to no longer send run-of-the-mill vulnerability reports in here, we won't instantly achieve that. Sure the moderators can stop and re-route them, but that's not an easy job. It's tricky to draw the line between run-of-the-mill and noteworthy.

Rather than tell people to send something to the other list, I ask this:

Whenever practical, please group related vulnerability disclosures into fewer messages (like security advisories) and use helpful Subject lines. Include the project name in a fixed place near the beginning of Subject, and make the Subject specific to the one disclosure rather than generic shared between multiple disclosures.

Example problems:

We got 25 messages on GPAC/MP4Box vulnerabilities in June so far. The Subject lines for them have GPAC/MP4Box in various places after the vulnerability type, whereas someone getting through this would first care what project is affected (is it even relevant to them) and would likely want messages grouped by project - if they have to be separate messages. Ideally, it would be just 2 messages - one on June 1st disclosing 6 issues, and one today disclosing 19 issues.

Conversely, some projects do group related issues, but then what goes into the Subject? We just had another "OpenSSL Security Advisory" a few days ago. It's the same generic Subject line every time. I think it'd be preferable to include some identifying information in there, at least "OpenSSL Security Advisory [9th June 2026]" as the first line says. Many other projects get this right, e.g. with Subject lines containing fixed release version numbers or identifying numbers for advisories or lists of CVEs. This is NOT a dig at Eric Covener (Apache). In fact, I want to praise Eric Covener (Apache) for his effort Indeed.

I greatly appreciate that Apache projects post their CVE disclosures in here, but it does sometimes result in a lot of messages for the same project on the same day. Also sometimes individual CVEs are missed - like for the previous (not the latest) Apache httpd set of CVEs, I spent some time to ensure all were eventually brought in here, as initially some were not. If some CVE disclosures are similarly missed for a less popular Apache project, this would remain unnoticed (maybe already was).

I understand it took time and effort to get the current system working well, but maybe it's time for someone at Apache to start looking into updating the system to group CVE disclosures by project and release.

Ditto for Perl CPAN.

Alexander

A stack overflow in the gfopusreadlength function (mediatools/avparsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A segmentation violation in the TrackSetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.