Vulnerability in MP4Box Could Lead to Null Pointer Dereference
CVE-2024-6062

5.5MEDIUM

Key Information:

Vendor

GPAC

Status
Gpac
Vendor
CVE Published:
17 June 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-6062?

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 31e499d310a48bd17c8b055a0bfe0fe35887a7cd. It is recommended to apply a patch to fix this issue. VDB-268790 is the identifier assigned to this vulnerability.

Affected Version(s)

GPAC 2.5-DEV-rev228-g11067ea92-master

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-6062 - Proof of Concept

References

https://vuldb.com/?id.268790
vdb-entrytechnical-description
https://vuldb.com/?ctiid.268790
signaturepermissions-required
https://vuldb.com/?submit.356314
third-party-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fantasy (VulDB User)
.