deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20754
Published: 2021-08-18
Description: Improper input validation vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Workflow without the appropriate privilege.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20755
Published: 2021-08-18
Description: Viewing restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without the viewing privilege.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20756
Published: 2021-08-18
Description: Viewing restrictions bypass vulnerability in Address of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Address without the viewing privilege.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20757
Published: 2021-08-18
Description: Operational restrictions bypass vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal without the appropriate privilege.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20758
Published: 2021-08-18
Description: Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication of administrators and perform an arbitrary operation via unspecified vectors.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20759
Published: 2021-08-18
Description: Operational restrictions bypass vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal without the appropriate privilege.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20760
Published: 2021-08-18
Description: Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profile without the appropriate privilege.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20761
Published: 2021-08-18
Description: Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege to alter the data of E-mail without the appropriate privilege.
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20762
Published: 2021-08-18
Description: Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated to alter the data of E-mail without the appropriate privilege.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20763
Published: 2021-08-18
Description: Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without the appropriate privilege.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20764
Published: 2021-08-18
Description: Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Attaching Files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20765
Published: 2021-08-18
Description: Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20766
Published: 2021-08-18
Description: Cross-site scripting vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20767
Published: 2021-08-18
Description: Cross-site scripting vulnerability in Full Text Search of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20768
Published: 2021-08-18
Description: Operational restrictions bypass vulnerability in Scheduler and MultiReport of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to delete the data of Scheduler and MultiReport without the appropriate privilege.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20769
Published: 2021-08-18
Description: Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20770
Published: 2021-08-18
Description: Cross-site scripting vulnerability in Message of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20771
Published: 2021-08-18
Description: Cross-site scripting vulnerability in some functions of E-Mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20772
Published: 2021-08-18
Description: Information disclosure vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the title of Bulletin without the viewing privilege.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20773
Published: 2021-08-18
Description: There is a vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.0, which may allow a remote authenticated attacker to delete the route information Workflow without the appropriate privilege.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20774
Published: 2021-08-18
Description: Cross-site scripting vulnerability in some functions of E-mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20775
Published: 2021-08-18
Description: Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and Space without the viewing privilege.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2021/007206.html; https://jvn.jp/en/jp/JVN54794245/index.html; https://cs.cybozu.co.jp/2021/007206.html
CVE: CVE-2021-20792
Published: 2021-08-18
Description: Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN65388002/index.html; https://plugins.trac.wordpress.org/changeset?new=2503364%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php&old=2490516%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php; https://quizandsurveymaster.com/
CVE: CVE-2021-3587
Published: 2021-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-38208. Reason: This candidate is a reservation duplicate of CVE-2021-38208. Notes: All CVE users should reference CVE-2021-38208 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2021-33580
Published: 2021-08-18
Description: User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.openwall.com/lists/oss-security/2021/08/18/1; https://lists.apache.org/thread.html/r9d967d80af941717573e531db2c7353a90bfd0886e9b5d5d79f75506%40%3Cuser.roller.apache.org%3E; http://www.openwall.com/lists/oss-security/2021/08/18/1
CVE: CVE-2021-37608
Published: 2021-08-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://lists.apache.org/thread.html/r164c91c47d638869c38e41b3ce501ecaa71f385939f098b2e04df049%40%3Cnotifications.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r21f76ccb0fca2e2b236328d91b9d4b760352fae6293d5275f1c25a3a%40%3Cnotifications.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r23d04e9c477c3547f6cc87f[PII_REDACTED]927053bbac15b72645ac7b%40%3Ccommits.ofbiz.apache.org%3E
CVE: CVE-2021-31820
Published: 2021-08-18
Description: In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://advisories.octopus.com/adv/2021-07---Proxy-Password-Stored-in-Plaintext-%28CVE-2021-31820%29[PII_REDACTED].html; https://advisories.octopus.com/adv/2021-07---Proxy-Password-Stored-in-Plaintext-%28CVE-2021-31820%29[PII_REDACTED].html
CVE: CVE-2021-21825
Published: 2021-08-18
Description: A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1290; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1290
CVE: CVE-2021-21837
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21838
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21839
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21843
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. After validating the number of ranges, at [41] the library will multiply the count by the size of the GF_SubsegmentRangeInfo structure. On a 32-bit platform, this multiplication can result in an integer overflow causing the space of the array being allocated to be less than expected. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21844
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when encountering an atom using the “stco” FOURCC code, can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21845
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stsc” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21846
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stsz” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21847
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21851
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input at “csgp” decoder sample group description indices can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21852
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input at “stss” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2023/dsa-5411; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21853
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299
CVE: CVE-2021-21854
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299
CVE: CVE-2021-21855
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299
CVE: CVE-2021-21856
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299
CVE: CVE-2021-21857
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299
CVE: CVE-2021-21858
Published: 2021-08-18
Description: Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1299