Infinite Loop Vulnerability in MP4Box Affects GPAC 2.5-DEV-rev228-g11067ea92-master
CVE-2024-6061

5.5MEDIUM

Key Information:

Vendor

GPAC

Status
Gpac
Vendor
CVE Published:
17 June 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-6061?

A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability.

Affected Version(s)

GPAC 2.5-DEV-rev228-g11067ea92-master

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-6061 - Proof of Concept

References

https://vuldb.com/?id.268789
vdb-entrytechnical-description
https://vuldb.com/?ctiid.268789
signaturepermissions-required
https://vuldb.com/?submit.356308
third-party-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fantasy (VulDB User)
.