Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2018-20763: GPAC Media Player: Out-of-Bounds Write in Text Import
CVE-2018-20763 · published 7 years ago
Summary
GPAC media player versions 0.7.1 and earlier have a security issue that could allow an attacker to potentially write data outside a designated area in memory. This could be used to potentially execute malicious code on a system. To stay safe, update to the latest version of GPAC.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gpac_project | gpac |
<= 0.7.1 cpe:2.3:a:gpac_project:gpac:*:*:*:*:*:*:*:* |
| debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| canonical | ubuntu_linux |
16.04 18.04 18.10 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
Original advisory text
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
References
- https://github.com/gpac/gpac/commit/1c449a34fe0b50aaffb881bfb9d7c5ab0bb18cdd Patch Third Party Advisory
- https://github.com/gpac/gpac/issues/1188 Exploit Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html Mailing List Third Party Advisory
- https://usn.ubuntu.com/3926-1/ Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published6 Feb 2019
Updated4 Nov 2026
First seen11 Apr 2026
Track software like this
Free during beta