CVE-2024-6061

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-6061
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6061.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-6061
Downstream
Published
2024-06-17T20:15:14Z
Modified
2025-10-22T07:36:43.802360Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffinprocess of the file src/filters/isoffinread.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability.

References

Affected packages

Git / github.com/gpac/gpac

Affected ranges

Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
20c0f29139a82779b86453ce7f68d0681ec7624c

Affected versions

v0.*

v0.5.2
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.8.0
v0.9.0
v0.9.0-preview

v1.*

v1.0.0
v1.0.1

v2.*

v2.0.0
v2.2.0
v2.4.0

Database specific

vanir_signatures

[
    {
        "id": "CVE-2024-6061-06a728a0",
        "source": "https://github.com/gpac/gpac/commit/20c0f29139a82779b86453ce7f68d0681ec7624c",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "82826429844619523383150276635996207977",
                "223451785876063139108151738789442768646",
                "291346274226980622887374031427042398623",
                "29513445435859194461526932149305897241"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "src/filters/isoffin_read_ch.c"
        },
        "signature_type": "Line",
        "deprecated": false
    },
    {
        "id": "CVE-2024-6061-33f6505f",
        "source": "https://github.com/gpac/gpac/commit/20c0f29139a82779b86453ce7f68d0681ec7624c",
        "signature_version": "v1",
        "digest": {
            "length": 10828.0,
            "function_hash": "121404883394162689383724574024371345170"
        },
        "target": {
            "function": "isor_reader_get_sample",
            "file": "src/filters/isoffin_read_ch.c"
        },
        "signature_type": "Function",
        "deprecated": false
    },
    {
        "id": "CVE-2024-6061-4b353c2d",
        "source": "https://github.com/gpac/gpac/commit/20c0f29139a82779b86453ce7f68d0681ec7624c",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "121335604946466732700162370428006419733",
                "102955359154449979516601365150611200411",
                "268040370239487289157776968609277393427",
                "71125018046347913686364609720781995703",
                "276520086285450442918156344363317422580",
                "215022192707771272081021522107923426872",
                "256143106398943353724665544548418120366",
                "82840995530729416114501551945382029342"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "src/filters/isoffin_read.c"
        },
        "signature_type": "Line",
        "deprecated": false
    },
    {
        "id": "CVE-2024-6061-8c950ece",
        "source": "https://github.com/gpac/gpac/commit/20c0f29139a82779b86453ce7f68d0681ec7624c",
        "signature_version": "v1",
        "digest": {
            "length": 10464.0,
            "function_hash": "149935532799910368737359551955358146738"
        },
        "target": {
            "function": "isoffin_process",
            "file": "src/filters/isoffin_read.c"
        },
        "signature_type": "Function",
        "deprecated": false
    }
]