CVE-2021-21844
medium
CVSS v3
—
CVSS v2
—
VIR risk
5.5
Description
Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when encountering an atom using the “stco” FOURCC code, can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2021-21844
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | affected | | |
| debian | bullseye | fixed | 1.0.1+dfsg1-4+deb11u1 |
References
Verify integrity in audit chain (admin only). AS-IS.