GPAC up to 0.7.2 text_import.c gf_text_get_utf8_line out-of-bounds write

Summaryinfo

A vulnerability identified as critical has been detected in GPAC up to 0.7.2. The affected element is the function gf_text_get_utf8_line of the file media_tools/text_import.c. Performing a manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2018-20763. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability was found in GPAC up to 0.7.2. It has been classified as critical. This affects the function gf_text_get_utf8_line of the file media_tools/text_import.c. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In GPAC through 0.7.2, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.

The bug was discovered 12/22/2018. The weakness was disclosed 02/06/2019 (Website). It is possible to read the advisory at lists.debian.org. This vulnerability is uniquely identified as CVE-2018-20763 since 02/06/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 46 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 176694 (Debian Security Update for gpac (DLA 1693-1)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-114187, VDB-130584, VDB-130585 and VDB-130586 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Multimedia Player Software

Name

• GPAC

Version

• 0.7.0
• 0.7.1
• 0.7.2

License

• open-source

Website

• Product: https://github.com/gpac/gpac/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion