NULL pointer dereference in Gpac
CVE-2024-6063
A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.
EPSS: 0.003 (25.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Gpac — versions 2.5-dev-rev288-g11067ea92-master
- N/a Gpac — versions 2.5-DEV-rev228-g11067ea92-master
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (Permissions Required, technical-description, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required)
- cna@vuldb.com (Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Third Party Advisory)
- cna@vuldb.com (exploit, broken-link, Broken Link)
- cna@vuldb.com (Patch, patch)
Frequently asked questions
- What is CVE-2024-6063?
- CVE-2024-6063 is a low-severity vulnerability in Gpac, classified under NULL Pointer Dereference. CVSS score: 3.3/10. Published 2024-06-17.
- How severe is CVE-2024-6063?
- Low severity. CVSS v3 base score is 3.3 out of 10.
- Is CVE-2024-6063 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.