The binary MP4Box in Gpac from 0.9.0-preview to 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Weakness
The product calls free() twice on the same memory address.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gpac | Gpac | 0.9.0 (including) | 1.0.1 (including) |
| Gpac | Ubuntu | bionic | * |
| Gpac | Ubuntu | focal | * |
| Gpac | Ubuntu | hirsute | * |
| Gpac | Ubuntu | impish | * |
| Gpac | Ubuntu | kinetic | * |
| Gpac | Ubuntu | lunar | * |
| Gpac | Ubuntu | trusty | * |
| Gpac | Ubuntu | trusty/esm | * |
| Gpac | Ubuntu | xenial | * |
Potential Mitigations
References
- https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L232
- https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L304
- https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb
- https://github.com/gpac/gpac/issues/1897
- https://www.debian.org/security/2023/dsa-5411
- https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb
- https://github.com/gpac/gpac/issues/1897
- https://www.debian.org/security/2023/dsa-5411