CVE-2021-21848 Integer overflow in GPAC Project
An integer overflow in GPAC's MPEG-4 decoder allows attackers to execute arbitrary code or cause denial of service via a malicious video file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21848?
CVE-2021-21848 is a high-severity vulnerability in Debian Debian Linux, published on 25 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The library will actually reuse the parser for atoms with the “stsz” FOURCC code when parsing atoms that use the “stz2” FOURCC code and can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
Which versions are affected by CVE-2021-21848?
It affects 2 products.
Products include Debian Debian Linux, Gpac Gpac.
How do I fix CVE-2021-21848?
Upgrade to a fixed version.
Is CVE-2021-21848 being exploited?
There is no known exploitation of CVE-2021-21848 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2021-21848, GHSA-q7q4-gw8j-595q, UBUNTU-CVE-2021-21848.