CVE-2018-13006

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00024.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/3926-1/Third Party Advisory
https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00024.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/3926-1/Third Party Advisory

Timeline

Published: Jun 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-130079.8An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to CVE-2018-130089.8An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to CVE-2018-130099.8An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to CVE-2018-13015.9A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size li CVE-2018-130108.8WSTMall v1.9.1_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account.CVE-2018-130119.8An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate.CVE-2018-130128.1Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft CVE-2018-130137.8Improper check of unusual conditions when launching msiexec.exe in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWa CVE-2018-130147.8Storing password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSof CVE-2018-13025.9When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer po CVE-2018-130217.2An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin CVE-2018-130226.1Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScrip