CVE-2021-30019

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gpac/gpac/commit/22774aa9e62f586319c8f107f5bae950fed900bcPatch, Third Party Advisory
https://github.com/gpac/gpac/issues/1723Exploit, Third Party Advisory
https://github.com/gpac/gpac/commit/22774aa9e62f586319c8f107f5bae950fed900bcPatch, Third Party Advisory
https://github.com/gpac/gpac/issues/1723Exploit, Third Party Advisory

Timeline

Published: Apr 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-30026.1Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.CVE-2021-300205.5In the function gf_hevc_read_pps_bs_internal function in media_tools/av_parsers.c in GPAC 1.0.1 there is a loop, which with crafted file, pp CVE-2021-300225.5There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC from 0.5.2 to 1.0.1. pps_id may be a nega CVE-2021-300275.5md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malform CVE-2021-300287.2SOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password for the admin account) to access the TELNET CVE-2021-30035.3Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle CVE-2021-300305.4Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.CVE-2021-300345.4Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.CVE-2021-300395.4Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.CVE-2021-30047.5The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calcu CVE-2021-300425.4Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinic CVE-2021-300445.4Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.