[Git][security-tracker-team/security-tracker][master] LTS: update CVE-2021-32134/gpac notes

[Roberto C. Sánchez (@roberto)]

Roberto C. Sánchez pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cbf493b6 by Roberto C. Sánchez at 2022-04-09T10:21:46-04:00
LTS: update CVE-2021-32134/gpac notes

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -59945,6 +59945,8 @@ CVE-2021-32134 (The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to
 	[buster] - ccextractor <not-affected> (Vulnerable code introduced later)
 	NOTE: https://github.com/gpac/gpac/commit/328c6d682698fdb9878dbb4f282963d42c538c01 (v2.0.0)
 	NOTE: https://github.com/gpac/gpac/issues/1756
+	NOTE: The POC from the GitHub issue produces a SIGSEV in the stretch/buster version of gpac, but in an entirely different call chain; it appears to be a different issue altogether
+	NOTE: It isn't clear if that means this CVE doesn't apply to stretch/buster, or if it is masking the issue with an earlier failure
 CVE-2021-32133
 	RESERVED
 CVE-2021-32132 (The abst_box_size function in GPAC 1.0.1 allows attackers to cause a d ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cbf493b662412580be67340e3f85249c159022b7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cbf493b662412580be67340e3f85249c159022b7
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220409/75950d1f/attachment.htm>