CVE-2023-4679

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38. This vulnerability can lead to a double-free condition, which may cause the application to crash.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
gpac	gpac/gpac	>= unspecified, < 2.3-DEV
gpac	gpac	< 2.3-DEV

References

https://github.com/gpac/gpac/commit/b68b3f0bf5c366e003221d78fd663a1d5514a876Patch
https://huntr.com/bounties/6f721ee7-8785-4c26-801e-f40fed3faaacExploit, Third Party Advisory

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-467939.8Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'registe CVE-2023-46806.8HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encry CVE-2023-468009.8Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_prof CVE-2023-468018.8In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java CVE-2023-468025.5e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded CVE-2023-468037.5An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-468047.5An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-468058.2An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc CVE-2023-468066.7An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege t CVE-2023-468076.7An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or CVE-2023-468089.9An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Success CVE-2023-468097.4Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are