The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4966 advisory.

  - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC     Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when decoding the atom for     the co64 FOURCC can cause an integer overflow due to unchecked arithmetic resulting in a heap-based     buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger     this vulnerability. (CVE-2021-21834)

  - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC     Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input using the ctts FOURCC code     can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that     causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
    (CVE-2021-21836)

  - Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of     the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer     overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory     corruption. An attacker can convince a user to open a video to trigger this vulnerability.
    (CVE-2021-21837, CVE-2021-21838, CVE-2021-21839)

  - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC     Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input used to process an atom using     the saio FOURCC code cause an integer overflow due to unchecked arithmetic resulting in a heap-based     buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger     this vulnerability. (CVE-2021-21840)

  - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC     Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when reading an atom using     the 'sbgp' FOURCC code can cause an integer overflow due to unchecked arithmetic resulting in a heap-based     buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger     this vulnerability. (CVE-2021-21841)

  - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC     Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow     when processing an atom using the 'ssix' FOURCC code, due to unchecked arithmetic resulting in a heap-     based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to     trigger this vulnerability. (CVE-2021-21842)

  - Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of     the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer     overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory     corruption. After validating the number of ranges, at [41] the library will multiply the count by the size     of the GF_SubsegmentRangeInfo structure. On a 32-bit platform, this multiplication can result in an     integer overflow causing the space of the array being allocated to be less than expected. An attacker can     convince a user to open a video to trigger this vulnerability. (CVE-2021-21843)

  - Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of     the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when encountering an     atom using the stco FOURCC code, can cause an integer overflow due to unchecked arithmetic resulting in     a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a     video to trigger this vulnerability. (CVE-2021-21844)

  - Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of     the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in stsc decoder     can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that     causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
    (CVE-2021-21845)

  - Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of     the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in stsz decoder     can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that     causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
    (CVE-2021-21846)

  - Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of     the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in stts decoder     can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that     causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
    (CVE-2021-21847)

  - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC     Project on Advanced Content library v1.0.1. The library will actually reuse the parser for atoms with the     stsz FOURCC code when parsing atoms that use the stz2 FOURCC code and can cause an integer overflow     due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An     attacker can convince a user to open a video to trigger this vulnerability. (CVE-2021-21848)

  - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC     Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow     when the library encounters an atom using the tfra FOURCC code due to unchecked arithmetic resulting in     a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a     video to trigger this vulnerability. (CVE-2021-21849)

  - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC     Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow     when the library encounters an atom using the trun FOURCC code due to unchecked arithmetic resulting in     a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a     video to trigger this vulnerability. (CVE-2021-21850)

  - Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of     the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer     overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory     corruption. An attacker can convince a user to open a video to trigger this vulnerability.
    (CVE-2021-21853, CVE-2021-21854, CVE-2021-21855, CVE-2021-21857, CVE-2021-21858)

  - An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the     GPAC Project on Advanced Content library v1.0.1. The stri_box_read function is used when processing atoms     using the 'stri' FOURCC code. An attacker can convince a user to open a video to trigger this     vulnerability. (CVE-2021-21859)

  - An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the     GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an improper     memory allocation resulting in a heap-based buffer overflow that causes memory corruption. The FOURCC     code, 'trik', is parsed by the function within the library. An attacker can convince a user to open a     video to trigger this vulnerability. (CVE-2021-21860)

  - An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the     GPAC Project on Advanced Content library v1.0.1. When processing the 'hdlr' FOURCC code, a specially     crafted MPEG-4 input can cause an improper memory allocation resulting in a heap-based buffer overflow     that causes memory corruption. An attacker can convince a user to open a video to trigger this     vulnerability. (CVE-2021-21861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-21 (GPAC: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in GPAC. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
152943	Debian DSA-4966-1 : gpac - security update	Nessus	Debian Local Security Checks	9/1/2021	12/1/2023	high
205345	GLSA-202408-21 : GPAC: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	8/10/2024	9/30/2024	critical

Detections

Analytics

Plugins Search

high

critical