CVE-2021-33365

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gpac/gpac/commit/984787de3d414a5f7d43d0b4584d9469dff2a5a5Patch, Third Party Advisory
https://github.com/gpac/gpac/issues/1784Issue Tracking, Patch, Third Party Advisory
https://www.debian.org/security/2023/dsa-5411
https://github.com/gpac/gpac/commit/984787de3d414a5f7d43d0b4584d9469dff2a5a5Patch, Third Party Advisory
https://github.com/gpac/gpac/issues/1784Issue Tracking, Patch, Third Party Advisory
https://www.debian.org/security/2023/dsa-5411

Timeline

Published: Sep 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-333665.5Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.CVE-2021-333675.5Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file.CVE-2021-33377.5The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicki CVE-2021-333715.4A stored cross-site scripting (XSS) vulnerability in /nav_bar_action.php of Student Management System v1.0 allows attackers to execute arbit CVE-2021-333879.6Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.CVE-2021-333889.8dpic 2021.04.10 has a Heap Buffer Overflow in themakevar() function in dpic.y CVE-2021-33394.3ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the CVE-2021-333909.8dpic 2021.04.10 has a use-after-free in thedeletestringbox() function in dpic.y. A different vulnerablility than CVE-2021-32421.CVE-2021-333919.8An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.CVE-2021-333938.8lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by a CVE-2021-333945.4Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user CVE-2021-333966.5Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbit