QwikSec

Security Database

CVE

CWE

Training

CVE-2023-0841

Published: Feb 15, 2023

Modified: Feb 13, 2025

PUBLISHED

CVSS v3.1

6.3

MEDIUM

Description

A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_process of the file filters/reframe_mp3.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221087.

Vendor	Product	Versions
n/a	GPAC	affected `2.3-DEV-rev40-g3602a5ded`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

https://vuldb.com/?id.221087

vdb-entry

technical-description

https://vuldb.com/?ctiid.221087

signature

permissions-required

https://github.com/qianshuidewajueji/poc/blob/main/gpac/mp3_dmx_process_poc3

exploit

https://github.com/advisories/GHSA-w52x-cp47-xhhw

https://github.com/gpac/gpac/releases/tag/v2.2.1

https://github.com/gpac/gpac/commit/851560e3dc8155d45ace4b0d77421f241ed71dc4

https://github.com/gpac/gpac/issues/2396

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.