Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-40517 State: PUBLISHED Published: 2021-11-10T16:01:55 Last Updated: 2024-08-04T02:44:10.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. XSS Payload is placed in the name column of the updates table using database access. Additional Analyst Notes: - CVE Program Container: References: - https://airangel.com/hsmx-gateway/ - http://etizazmohsin.com/hsmx.html#xss
CVE ID: CVE-2021-40518 State: PUBLISHED Published: 2021-11-10T15:52:55 Last Updated: 2024-08-04T02:44:10.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airangel HSMX Gateway devices through 5.2.04 allow CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://airangel.com/hsmx-gateway/ - http://etizazmohsin.com/hsmx.html#csrf
CVE ID: CVE-2021-40519 State: PUBLISHED Published: 2021-11-10T15:57:09 Last Updated: 2024-08-04T02:44:10.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials. Additional Analyst Notes: - CVE Program Container: References: - https://airangel.com/hsmx-gateway/ - http://etizazmohsin.com/hsmx.html#database
CVE ID: CVE-2021-40520 State: PUBLISHED Published: 2021-11-10T16:06:12 Last Updated: 2024-08-04T02:44:10.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials. Additional Analyst Notes: - CVE Program Container: References: - https://airangel.com/hsmx-gateway/ - http://etizazmohsin.com/hsmx.html#ssh
CVE ID: CVE-2021-40521 State: PUBLISHED Published: 2021-11-10T15:55:23 Last Updated: 2024-08-04T02:44:10.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://airangel.com/hsmx-gateway/ - http://etizazmohsin.com/hsmx.html#rce
CVE ID: CVE-2021-40523 State: PUBLISHED Published: 2021-09-05T18:26:43 Last Updated: 2024-08-04T02:44:10.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of service. Specifically, a server sometimes sends no response, because a fixed buffer space is available for all responses and that space may have been exhausted. Additional Analyst Notes: - CVE Program Container: References: - https://g
onses and that space may have been exhausted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-os/contiki/issues/2686
CVE ID: CVE-2021-40524 State: PUBLISHED Published: 2021-09-05T18:26:26.000Z Last Updated: 2025-11-04T00:12:03.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jedisct1/pure-ftpd/pull/158 - https://github.com/jedisct1/pure-ftpd/compare/1.0.49...1.0.50 - https://github.co
thub.com/jedisct1/pure-ftpd/pull/158 - https://github.com/jedisct1/pure-ftpd/compare/1.0.49...1.0.50 - https://github.com/jedisct1/pure-ftpd/commit/37ad222868e52271905b94afea4fc780d83294b4
CVE ID: CVE-2021-40525 State: PUBLISHED Published: 2022-01-04T08:55:25 Last Updated: 2024-08-04T02:44:10.863Z Vendors: Apache Software Foundation Products: Apache James Problem Types: CWE-22 Description: Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/01/04/4 - http://www.openwall.com/lists/oss-security/2022/0
ferences: - https://www.openwall.com/lists/oss-security/2022/01/04/4 - http://www.openwall.com/lists/oss-security/2022/01/04/4 - http://www.openwall.com/lists/oss-security/2022/02/07/1
CVE ID: CVE-2021-40526 State: PUBLISHED Published: 2021-10-25T10:41:02 Last Updated: 2024-08-04T02:44:10.850Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead to an Apple MFI device not being able to authenticate with the Peleton Bike Additional Analyst Notes: - CVE Program Container: References: - https://twitter.co
o authenticate with the Peleton Bike Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/ROPsicle/status/1438216078103044107?s=20
CVE ID: CVE-2021-40527 State: PUBLISHED Published: 2021-10-25T10:40:53 Last Updated: 2024-08-04T02:44:10.787Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: n/a Products: n/a Problem Types: n/a Description: Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/ROPsicle/status/1438216078103044107?s=20
CVE ID: CVE-2021-40528 State: PUBLISHED Published: 2021-09-06T00:00:00.000Z Last Updated: 2025-06-09T15:13:03.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://eprint.iacr.org/2021/923 - https://ibm.github.io/syste
Program Container: - CISA ADP Vulnrichment: References: - https://eprint.iacr.org/2021/923 - https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1 - https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2 - https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d8861320 - https://security.gentoo.org/glsa/202210-13
CVE ID: CVE-2021-40529 State: PUBLISHED Published: 2021-09-06T18:45:08 Last Updated: 2024-08-04T02:44:10.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. Additional Analyst Notes: - CVE Program Container: References: - https://eprint.iacr.org/2021/923 - https://ibm.git
PGP. Additional Analyst Notes: - CVE Program Container: References: - https://eprint.iacr.org/2021/923 - https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1 - https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2 - https://github.com/randombit/botan/pull/2790 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPHGYWNJQKWLTUWBNSFB4F66MQDIL3IB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72NB4OLD3VHJC3YF3PEP2HKF6BYURPAO/ - https://security.gentoo.org/glsa/202208-14
CVE ID: CVE-2021-40530 State: PUBLISHED Published: 2021-09-06T18:44:47 Last Updated: 2024-08-04T02:44:10.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. Additional Analyst Notes: - CVE Program Container: References: - https://eprint.iacr.org/2021/923 - https://ibm.github.io/system-security-research-updates/2021
Container: References: - https://eprint.iacr.org/2021/923 - https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1 - https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGVBZ2TTRKCTYAZTRHTF6OBD4W37F5MT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57OJA2K5AHX5HAU2QBDRWLGIIUX7GASC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJYOZGWI7TD27SEXILSM6VUTPPEICDL7/
CVE ID: CVE-2021-40531 State: PUBLISHED Published: 2021-09-06T20:17:01 Last Updated: 2024-08-04T02:44:10.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app. Additional Analyst Notes: - CVE Program Container: References: - https://www.sketch.com/updates/#version-75 - https://jonpalmisc.com/2021/11/22/cve-2021-40531
CVE ID: CVE-2021-40532 State: PUBLISHED Published: 2021-09-06T20:23:58 Last Updated: 2024-08-04T02:44:10.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/morethanwords/tweb/commit/f224e459c36eb96b2cf9dba559a48b1f08d23330
CVE ID: CVE-2021-40537 State: PUBLISHED Published: 2021-09-08T17:26:56 Last Updated: 2024-08-04T02:44:10.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary for exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.com/security-advisories/cve-2021-40537/
CVE ID: CVE-2021-40539 State: PUBLISHED Published: 2021-09-07T16:06:58.000Z Last Updated: 2025-10-21T23:25:35.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com - https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html - http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
CVE ID: CVE-2021-40540 State: PUBLISHED Published: 2021-09-07T01:50:51 Last Updated: 2024-08-04T02:44:10.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/babelouest/ulfius/commit/c83f564c184a27145e07c274b305cabe943bbfaa - https://github.com/babelouest/ulfius/compare/v2.7.3...v2.7.4 - http://packetstormsecurity.com/files/164152/Ulfius-Web-Framework-Remote-Memory-Corruption.html
CVE ID: CVE-2021-40541 State: PUBLISHED Published: 2021-10-11T13:16:45 Last Updated: 2024-08-04T02:44:10.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can trigger XSS by appending "//" in the end of text. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PHPFusion/PHPFusion/issues/2373
CVE ID: CVE-2021-40542 State: PUBLISHED Published: 2021-10-11T12:44:52 Last Updated: 2024-08-04T02:44:10.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute JavaScript code through the link_url parameter in Ajax_url_encode.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/189
CVE ID: CVE-2021-40543 State: PUBLISHED Published: 2021-10-11T12:19:19 Last Updated: 2024-08-04T02:44:10.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET['prof_id'] in the PasswordCheck.php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/191
CVE ID: CVE-2021-40546 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-10-01T13:11:51.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device crash) via a long string in the wifiPwd_5G parameter to /goform/setWifi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/doudoudedi/buffer_overflow/blob/main/Tenda%20AC6%20V4.0-Denial%20of%20Service%20Vulnerability.md
CVE ID: CVE-2021-40553 State: PUBLISHED Published: 2022-06-28T16:22:23 Last Updated: 2024-08-04T02:44:10.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yang9999999/vuln/blob/main/README.md
CVE ID: CVE-2021-40555 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-19T15:02:26.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flatCore/flatCore-CMS/issues/56
CVE ID: CVE-2021-40556 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-04T02:44:10.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266. This vulnerability is caused by the strcat function called by "caupload" input handle function allowing the user to enter 0xFFFF bytes into the stack. This vulnerability allows an attacker to execute commands remotely. The vulnerability requires authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/tw/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDes
Container: References: - https://www.asus.com/tw/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/ - https://x1ng.top/2021/10/14/ASUS%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
CVE ID: CVE-2021-40559 State: PUBLISHED Published: 2022-01-12T00:00:00 Last Updated: 2024-08-04T02:44:10.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer deference vulnerability exists in gpac through 1.0.1 via the naludmx_parse_nal_avc function in reframe_nalu, which allows a denail of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1886 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40562 State: PUBLISHED Published: 2022-01-12T00:00:00 Last Updated: 2024-08-04T02:44:10.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch function in reframe_nalu.c, which causes a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1901 - https://github.com/gpac/gpac/commit/5dd71c7201a3e5cf40732d585bfb21c906c171d3 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40563 State: PUBLISHED Published: 2022-01-12T00:00:00 Last Updated: 2024-08-04T02:44:10.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_decoder_config function in reframe_nalu.c when using mp4box, which causes a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1892 - https://github.com/gpac/gpac/commit/5ce0c906ed8599d218036b18b78e8126a496f137 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40564 State: PUBLISHED Published: 2022-01-12T00:00:00 Last Updated: 2024-08-04T02:44:10.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_slice function in av_parsers.c when using mp4box, which causes a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1898 - https://github.com/gpac/gpac/commit/cf6771c857eb9a290e2c19ddacfdd3ed98b27618 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40565 State: PUBLISHED Published: 2022-01-12T00:00:00 Last Updated: 2024-08-04T02:44:10.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_parse_nalu function in av_parsers.c when using mp4box, which causes a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1902 - https://github.com/gpac/gpac/commit/893fb99b606eebfae46cde151846a980e689039b - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40566 State: PUBLISHED Published: 2022-01-12T00:00:00 Last Updated: 2024-08-04T02:44:10.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using mp4box, which causes a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1887 - https://github.com/gpac/gpac/commit/96047e0e6166407c40cc19f4e94fb35cd7624391 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40567 State: PUBLISHED Published: 2022-01-13T00:00:00 Last Updated: 2024-08-04T02:44:10.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: Segmentation fault vulnerability exists in Gpac through 1.0.1 via the gf_odf_size_descriptor function in desc_private.c when using mp4box, which causes a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/commit/f5a038e6893019ee471b6a57490cf7a495673816 - https://github.com/gpac/gpac/issues/1889 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40568 State: PUBLISHED Published: 2022-01-13T00:00:00 Last Updated: 2024-08-04T02:44:10.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in Gpac through 1.0.1 via a malformed MP4 file in the svc_parse_slice function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1900 - https://github.com/gpac/gpac/commit/f1ae01d745200a258cdf62622f71754c37cb6c30 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40569 State: PUBLISHED Published: 2022-01-13T00:00:00 Last Updated: 2024-08-04T02:44:10.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c, which allows attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/commit/b03c9f252526bb42fbd1b87b9f5e339c3cf2390a - https://github.com/gpac/gpac/issues/1890 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40570 State: PUBLISHED Published: 2022-01-13T00:00:00 Last Updated: 2024-08-04T02:44:10.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1899 - https://github.com/gpac/gpac/commit/04dbf08bff4d61948bab80c3f9096ecc60c7f302 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40571 State: PUBLISHED Published: 2022-01-13T00:00:00 Last Updated: 2024-08-04T02:44:10.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1895 - https://github.com/gpac/gpac/commit/a69b567b8c95c72f9560c873c5ab348be058f340 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40572 State: PUBLISHED Published: 2022-01-13T00:00:00 Last Updated: 2024-08-04T02:44:10.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: The binary MP4Box in Gpac 1.0.1 has a double-free bug in the av1dmx_finalize function in reframe_av1.c, which allows attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1893 - https://github.com/gpac/gpac/commit/7bb1b4a4dd23c885f9db9f577dfe79ecc5433109 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40573 State: PUBLISHED Published: 2022-01-13T18:05:25 Last Updated: 2024-08-04T02:44:10.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_list_del function in list.c, which allows attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/commit/b03c9f252526bb42fbd1b87b9f5e339c3cf2390a - https://github.com/gpac/gpac/issues/1891