Debian update for gpac

1) Integer overflow

EUVDB-ID: #VU55886

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21834

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "co64" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU55900

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21848

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stz2” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU55878

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21861

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "hdlr" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Integer overflow

EUVDB-ID: #VU55877

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21860

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "trik" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Integer overflow

EUVDB-ID: #VU55876

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21859

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stri" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU55885

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21858

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "url" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Integer overflow

EUVDB-ID: #VU55884

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21857

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "txtc" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Integer overflow

EUVDB-ID: #VU55882

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21855

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "sdp" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Integer overflow

EUVDB-ID: #VU55881

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21854

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "rtp" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Integer overflow

EUVDB-ID: #VU55880

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21853

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "name" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Integer overflow

EUVDB-ID: #VU55902

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21850

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "trun” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Integer overflow

EUVDB-ID: #VU55901

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21849

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "tfra” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Integer overflow

EUVDB-ID: #VU55905

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21847

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "“stts” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Integer overflow

EUVDB-ID: #VU55888

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21836

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "ctts" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Integer overflow

EUVDB-ID: #VU55898

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21846

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stsz” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Integer overflow

EUVDB-ID: #VU55897

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21845

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stsc” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Integer overflow

EUVDB-ID: #VU55896

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21844

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "stco” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Integer overflow

EUVDB-ID: #VU55895

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21843

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "ssix” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Integer overflow

EUVDB-ID: #VU55894

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21842

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "ssix” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Integer overflow

EUVDB-ID: #VU55893

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21841

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "sbgp” decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Integer overflow

EUVDB-ID: #VU55892

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21840

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "saio" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Integer overflow

EUVDB-ID: #VU55891

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21839

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "pcrb" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Integer overflow

EUVDB-ID: #VU55890

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21838

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "fpar" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Integer overflow

EUVDB-ID: #VU55889

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21837

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the MPEG-4 decoding functionality within the "fecr" decoder. A remote attacker can trick a victim to open a video, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update gpac package to version 1.0.1+dfsg1-4+deb11u1.

Vulnerable software versions

gpac (Debian package): 1.0.1+dfsg1 - 1.0.1+dfsg1-3

External links

http://www.debian.org/security/2021/dsa-4966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	24
CVE-ID	CVE-2021-21834 CVE-2021-21848 CVE-2021-21861 CVE-2021-21860 CVE-2021-21859 CVE-2021-21858 CVE-2021-21857 CVE-2021-21855 CVE-2021-21854 CVE-2021-21853 CVE-2021-21850 CVE-2021-21849 CVE-2021-21847 CVE-2021-21836 CVE-2021-21846 CVE-2021-21845 CVE-2021-21844 CVE-2021-21843 CVE-2021-21842 CVE-2021-21841 CVE-2021-21840 CVE-2021-21839 CVE-2021-21838 CVE-2021-21837
CWE-ID	CWE-190
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	gpac (Debian package) Operating systems & Components / Operating system package or component
Vendor	Debian