CVE-2024-6063 — LOW (3.3) — White Hats Nepal

Vulnerability Description

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.

CVSS Score

3.3

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Gpac	Gpac	2.5-dev-rev288-g11067ea92-master

Related Weaknesses (CWE)

CWE-476

References

https://github.com/gpac/gpac/commit/8767ed0a77c4b02287db3723e92c2169f67c85d5Patch
https://github.com/gpac/gpac/issues/2873ExploitThird Party Advisory
https://github.com/user-attachments/files/15801157/poc.zipBroken Link
https://vuldb.com/?ctiid.268791Permissions Required
https://vuldb.com/?id.268791Permissions Required
https://vuldb.com/?submit.356315Third Party Advisory
https://github.com/gpac/gpac/commit/8767ed0a77c4b02287db3723e92c2169f67c85d5Patch
https://github.com/gpac/gpac/issues/2873ExploitThird Party Advisory
https://github.com/user-attachments/files/15801157/poc.zipBroken Link
https://vuldb.com/?ctiid.268791Permissions Required
https://vuldb.com/?id.268791Permissions Required
https://vuldb.com/?submit.356315Third Party Advisory

FAQ

What is CVE-2024-6063?

CVE-2024-6063 is a vulnerability with a CVSS score of 3.3 (LOW). A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the componen...

How severe is CVE-2024-6063?

CVE-2024-6063 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-6063?

Check the references section above for vendor advisories and patch information. Affected products include: Gpac Gpac.