CVE-2021-40564

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-40564
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-40564.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-40564
Downstream
Published
2022-01-12T22:15:07.847Z
Modified
2025-11-14T12:20:52.039144Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avcparseslice function in av_parsers.c when using mp4box, which causes a denial of service.

References

Affected packages

Git / github.com/gpac/gpac

Affected ranges

Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cf6771c857eb9a290e2c19ddacfdd3ed98b27618

Affected versions

v0.*

v0.5.2
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.8.0
v0.9.0
v0.9.0-preview

v1.*

v1.0.0
v1.0.1

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "source": "https://github.com/gpac/gpac/commit/cf6771c857eb9a290e2c19ddacfdd3ed98b27618",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "33139317742673087143301621788696875760",
                "40067023463941325579072277044494246212",
                "6858436001336251329503023834040476408",
                "215858056015409008606797735826477519635",
                "280664615792475706385971753107292148226",
                "285671375156926123525445493399398643339",
                "223018829820854772209840817076401493095",
                "218324005861058336068488887534003891768",
                "277825195111491555614094537885684252686",
                "256195421321412857773894656983395858737"
            ]
        },
        "deprecated": false,
        "target": {
            "file": "src/media_tools/av_parsers.c"
        },
        "id": "CVE-2021-40564-021e478c",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/gpac/gpac/commit/cf6771c857eb9a290e2c19ddacfdd3ed98b27618",
        "digest": {
            "length": 733.0,
            "function_hash": "242501853663965271778312182443974469698"
        },
        "deprecated": false,
        "target": {
            "function": "gf_bs_read_ue_log_idx3",
            "file": "src/media_tools/av_parsers.c"
        },
        "id": "CVE-2021-40564-27059077",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/gpac/gpac/commit/cf6771c857eb9a290e2c19ddacfdd3ed98b27618",
        "digest": {
            "length": 4231.0,
            "function_hash": "116652901503841662658803101052099390509"
        },
        "deprecated": false,
        "target": {
            "function": "avc_parse_slice",
            "file": "src/media_tools/av_parsers.c"
        },
        "id": "CVE-2021-40564-a254b421",
        "signature_version": "v1"
    }
]