[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#987374: marked as done (gpac: CVE-2020-35979 CVE-2020-35980 CVE-2020-35981 CVE-2020-35982)

Your message dated Tue, 25 May 2021 02:19:29 +0000
with message-id <E1llMfJ-000I6G-SI@fasolo.debian.org>
and subject line Bug#987374: fixed in gpac 1.0.1+dfsg1-4
has caused the Debian Bug report #987374,
regarding gpac: CVE-2020-35979 CVE-2020-35980 CVE-2020-35981 CVE-2020-35982
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
987374: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987374
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: gpac
Version: 1.0.1+dfsg1-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerabilities were published for gpac. Unfortunately
another round of CVEs. I'm not sure if you would actually like to have
to properly separate the CVEs per bug in such massive case, as in
particular we have not checked if as well they cover completely as set
the older version. Anyway, here is the additional list of CVEs
assigned for gpac:

CVE-2020-23928[0]:
| An issue was discovered in gpac before 1.0.1. The abst_box_read
| function in box_code_adobe.c has a heap-based buffer over-read.


CVE-2020-23930[1]:
| An issue was discovered in gpac through 20200801. A NULL pointer
| dereference exists in the function nhmldump_send_header located in
| write_nhml.c. It allows an attacker to cause Denial of Service.


CVE-2020-23931[2]:
| An issue was discovered in gpac before 1.0.1. The abst_box_read
| function in box_code_adobe.c has a heap-based buffer over-read.


CVE-2020-23932[3]:
| An issue was discovered in gpac before 1.0.1. A NULL pointer
| dereference exists in the function dump_isom_sdp located in
| filedump.c. It allows an attacker to cause Denial of Service.


CVE-2020-35979[4]:
| An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is
| heap-based buffer overflow in the function gp_rtp_builder_do_avc() in
| ietf/rtp_pck_mpeg4.c.


CVE-2020-35980[5]:
| An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a
| use-after-free in the function gf_isom_box_del() in
| isomedia/box_funcs.c.


CVE-2020-35981[6]:
| An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an
| invalid pointer dereference in the function SetupWriters() in
| isomedia/isom_store.c.


CVE-2020-35982[7]:
| An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an
| invalid pointer dereference in the function gf_hinter_track_finalize()
| in media_tools/isom_hinter.c.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-23928
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23928
[1] https://security-tracker.debian.org/tracker/CVE-2020-23930
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23930
[2] https://security-tracker.debian.org/tracker/CVE-2020-23931
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23931
[3] https://security-tracker.debian.org/tracker/CVE-2020-23932
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23932
[4] https://security-tracker.debian.org/tracker/CVE-2020-35979
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35979
[5] https://security-tracker.debian.org/tracker/CVE-2020-35980
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35980
[6] https://security-tracker.debian.org/tracker/CVE-2020-35981
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35981
[7] https://security-tracker.debian.org/tracker/CVE-2020-35982
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35982

Regards,
Salvatore

--- End Message ---
--- Begin Message --- 
Source: gpac
Source-Version: 1.0.1+dfsg1-4
Done: Reinhard Tartler <siretart@tauware.de>

We believe that the bug you reported is fixed in the latest version of
gpac, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 987374@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated gpac package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 24 May 2021 21:09:10 -0400
Source: gpac
Architecture: source
Version: 1.0.1+dfsg1-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Closes: 987280 987323 987374
Changes:
 gpac (1.0.1+dfsg1-4) unstable; urgency=medium
 .
   [ Moritz Muehlenhoff ]
   * Cherrypicked fixes for multiple security issues:
     (Closes: #987280, #987323, #987374)
     - CVE-2021-30014/CVE-2021-30020/CVE-2021-30022
     - CVE-2020-35979
     - CVE-2020-35981
     - CVE-2020-35982
     - CVE-2021-28300
     - CVE-2021-29279
     - CVE-2021-31255
     - CVE-2021-31256
     - CVE-2021-31261
     - CVE-2021-30015
     - CVE-2021-30019
     - CVE-2021-30199
     - CVE-2021-31257
     - CVE-2021-31258
     - CVE-2021-31260
     - CVE-2021-31262
 .
   [ Reinhard Tartler ]
   * upload to unstable
Checksums-Sha1:
 1128f53457ca2a28f393901a581173c7fe934acf 2701 gpac_1.0.1+dfsg1-4.dsc
 8522ee622dd8588bc681c8ab271d86d768e15f41 41604 gpac_1.0.1+dfsg1-4.debian.tar.xz
Checksums-Sha256:
 dbbad33437d44fa6a260635a5533c04348e2e2c3a8f49f6d56aca98454cea7a4 2701 gpac_1.0.1+dfsg1-4.dsc
 1552418a0caefa859e6393ac5a6e029c53145b5eec05d7aa07609d3fc42538ad 41604 gpac_1.0.1+dfsg1-4.debian.tar.xz
Files:
 72e4ea906f6fe29d9a95a5e7f0d14cbf 2701 graphics optional gpac_1.0.1+dfsg1-4.dsc
 f3769d6e6d4dc5404f3ecb08b13779da 41604 graphics optional gpac_1.0.1+dfsg1-4.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmCsVvsUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJsvLQQ/5AdK9+L9KTth9FtFO4ODNVpRdjyPX
nWdvft0AuKytOkUUTn9PMVLjSgqAY9wkynVJ1lHhGkgp5JNZ5dkvWYzPCa2Hxwmc
VtLvCi5JD9DH8BvVeGbVcbCZK0Re6W9wbJpRakJb2Um91lzJmmfcxKK5tT3iPFug
r1icOwk1/r4RpbHi/8RBIVD9wPBQsqa6V2OQilrdJ2yMAuQhJHXJK/ZI6PTW6xkb
sV68c2YEeysplRkX0RxQxMpLCyVwr5mBHNyVlcEg0xKMbjM1LKLaTnPP+8KYhuO3
/h5kvM0hCk+sMVqrThhRryK5KZ4+2jQ+Vwobbh1PQ6+k/KgS217+AzmIt1m/u5uP
JKTVaXaV6IsQy/px8scfij/RlXBRwDYgsR/qP43crICC0GQhrifpvvXuLzBouKCg
wTuogwTFOHJEOCtKSdL6t7M1FWSBFlmydJVrK+r8cKEK7/p9lKCOjURx8XII9TW7
7pSxvVC4Qk/EEDfoPHoyAnhNYj8owhmMZBt5xQvUTirwwyIUw3Ejauet6/dbZFQT
m57g/jpawNg9xeTULTtY6vEzlNLGU/M4WMb/WM1djZyoPfm9Th0s3e9g1MM2YqO2
jGKEo3tSUtIqVokNBHOcqomCex7mi6VBl7vXK43gWNO2v319oMxj7OX4OSbdypo9
511m8VUO4vgLyaY=
=0amP
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: