CVE-2019-20628 : Security Advisory and Response

A vulnerability has been found in libgpac.a in GPAC version 0.8.0 and earlier, leading to a denial of service risk when processing MP4 files.

Understanding CVE-2019-20628

This CVE identifies a Use-After-Free vulnerability in the gf_m2ts_process_pmt function within the mpegts.c file of the media_tools directory in GPAC.

What is CVE-2019-20628?

The vulnerability in libgpac.a in GPAC version 0.8.0 and earlier, demonstrated by MP4Box, allows for a denial of service attack through a specially crafted MP4 file.

The Impact of CVE-2019-20628

Exploitation of this Use-After-Free vulnerability could result in a denial of service by leveraging a specially crafted MP4 file.

Technical Details of CVE-2019-20628

This section provides more technical insights into the vulnerability.

Vulnerability Description

The issue resides in the gf_m2ts_process_pmt function within the mpegts.c file of the media_tools directory in GPAC before version 0.8.0.

Affected Systems and Versions

GPAC version 0.8.0 and earlier

Exploitation Mechanism

The vulnerability can be exploited by processing a malicious MP4 file, triggering the Use-After-Free flaw.

Mitigation and Prevention

Protecting systems from CVE-2019-20628 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update GPAC to version 0.8.0 or later to mitigate the vulnerability
Avoid opening untrusted MP4 files

Long-Term Security Practices

Regularly update software and libraries to the latest versions
Implement file validation checks to detect malicious MP4 files

Patching and Updates

Apply patches provided by GPAC to address the Use-After-Free vulnerability