Frank-Z7

**Name of the Vulnerable Software and Affected Versions** gpac version 2.4 **Description** The issue is related to a SEGV at src/isomedia/drm sample.c:1562:96 in the `isom cenc get sai by saiz saio` function in MP4Box. This indicates a potential problem with memory access or handling in the specified function. **Recommendations** For gpac version 2.4, consider disabling the `isom cenc get sai by saiz saio` function until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gpac version 2.4 **Description** The issue is a heap-buffer-overflow in the gpac/MP4Box module, specifically at isomedia/sample descs.c:1799 in the gf isom new mpha description function. **Recommendations** For gpac version 2.4, as a temporary workaround, consider disabling the `gf isom new mpha description` function until a patch is available. Restrict access to the gpac/MP4Box module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenJPEG (affected versions not specified) **Description** A flaw was found in the OpenJPEG project, where a heap buffer overflow condition may be triggered when certain options are specified while using the opj decompress utility. This can lead to an application crash or other undefined behavior. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenJPEG project (affected versions not specified) **Description** A flaw was found in the OpenJPEG project, where a heap buffer overflow condition may be triggered when certain options are specified while using the `opj decompress` utility. This can lead to an application crash or other undefined behavior. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenImageIO version 3.1.0.0dev **Description** An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO may cause a Denial of Service (DoS) when the program requests to allocate too much space. **Recommendations** For OpenImageIO version 3.1.0.0dev, as a temporary workaround, consider restricting the allocation size in the /imagebuf.cpp component to prevent excessive space allocation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenImageIO version 3.1.0.0dev **Description** A segmentation violation was discovered in OpenImageIO via the component /OpenImageIO/string view.h. This issue affects the specified version of OpenImageIO. **Recommendations** For OpenImageIO version 3.1.0.0dev, as a temporary workaround, consider restricting access to the /OpenImageIO/string view.h component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenImageIO version 3.1.0.0dev **Description** A heap overflow issue was discovered in OpenImageIO via the component OpenImageIO v3 1 0::farmhash::inlined::Fetch64(char const*). **Recommendations** For OpenImageIO version 3.1.0.0dev, as a temporary workaround, consider disabling the `Fetch64` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 2.3-DEV-rev605-gfc9e29089-master **Description** An issue in GPAC's MP4Box, specifically in the `gf avc change vui` function, allows attackers to crash the application. This is related to a lack of protection measures for the structure of web pages, which can be exploited by a remote attacker to cause a denial of service. **Recommendations** As a temporary workaround, consider disabling the `gf avc change vui` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenImageIO version 3.1.0.0dev **Description** A heap overflow issue was discovered in OpenImageIO through the component /OpenImageIO/fmath.h. **Recommendations** For OpenImageIO version 3.1.0.0dev, consider disabling the functionality related to the /OpenImageIO/fmath.h component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.0.12 **Description** The issue is related to a buffer overflow in the libde265 video codec implementation, specifically concerning the allocation size exceeding the maximum supported size of 0x10000000000. This can be exploited by an attacker to cause a denial of service. The exploitation does not require local access, as a remote attacker can also trigger the issue. **Recommendations** For libde265 version 1.0.12, consider applying a patch or update that fixes the buffer overflow issue, if available. As a temporary workaround, restrict the allocation size to prevent it from exceeding the maximum supported size of 0x10000000000.

**Name of the Vulnerable Software and Affected Versions** libde265 version 1.10.12 **Description** The issue is related to a buffer overflow vulnerability in the slice segment header function within the slice.cc component of the libde265 video codec implementation. This vulnerability can be exploited by a remote attacker to cause a denial of service due to unchecked input size during buffer copying. **Recommendations** For libde265 version 1.10.12, consider disabling the `slice segment header()` function as a temporary workaround until a patch is available. Restrict access to the vulnerable slice.cc component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** jbig2enc version 0.28 **Description** The issue is related to a SEGV (Segmentation Violation) in the jbig2enc library. It occurs via the `jbig2 add page` function in the src/jbig2enc.cc file at line 512. **Recommendations** For jbig2enc version 0.28, consider applying a patch or fix to resolve the SEGV issue in the `jbig2 add page` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** jbig2enc version 0.28 **Description** A heap-use-after-free issue was discovered in jbig2enc via the function `jbig2enc auto threshold using hash` in the file `src/jbig2enc.cc`. **Recommendations** For jbig2enc version 0.28, consider disabling the `jbig2enc auto threshold using hash` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 2.3-DEV-rev605-gfc9e29089-master **Description** The issue is related to a buffer overflow in the `gf media change pl()` function of the GPAC multimedia platform. This can lead to a denial of service when exploited. The vulnerability is located in the `gpac/MP4Box` component, specifically in the `isom tools.c` file at line 3293. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 2.3-DEV-rev605-gfc9e29089-master **Description** The issue is related to a buffer overflow in the `gf isom find od id for track()` function of the GPAC multimedia platform. This can lead to a denial of service. The vulnerable function is located in `gpac/MP4Box` at `afltest/gpac/src/isomedia/media odf.c:522:14`. **Recommendations** For GPAC version 2.3-DEV-rev605-gfc9e29089-master, consider disabling the `gf isom find od id for track()` function as a temporary workaround until a patch is available. Restrict access to the `gpac/MP4Box` module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 2.3-DEV-rev605-gfc9e29089-master **Description** The issue is related to a heap-buffer-overflow in the `gf isom use compact size()` function of the GPAC multimedia platform. This can be exploited to cause a denial of service. The vulnerability is located in the `gpac/src/isomedia/isom write.c` file at line 3403. **Recommendations** For GPAC version 2.3-DEV-rev605-gfc9e29089-master, consider disabling the `gf isom use compact size()` function as a temporary workaround until a patch is available. Restrict access to the `gpac/src/isomedia/isom write.c` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 2.3-DEV-rev605-gfc9e29089-master **Description** The issue is a heap-buffer-overflow in the `ffdmx parse side data` function located at `/afltest/gpac/src/filters/ff dmx.c:202:14` in `gpac/MP4Box`. This indicates a problem with how data is handled, potentially leading to memory corruption. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OptiPNG version 0.7.7 **Description** The issue is related to a global buffer overflow via the `buffer` variable at gifread.c. This can potentially allow an attacker to cause a denial of service or other impact. **Recommendations** For OptiPNG version 0.7.7, update the optipng package to fix the security vulnerability. As a temporary workaround, consider restricting the use of the GIF handler to minimize the risk of exploitation.