CVE-2021-21860: debian debian_linux Integer Overflow to Buffer Overflow

Vulnerability summary

CVE-2021-21860 is a high (CVSS 8.8) Integer Overflow to Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 1.63% chance of exploitation in the next 30 days, higher than 75.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-08-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an improper memory allocation resulting in a heap-based buffer overflow that causes memory corruption. The FOURCC code, 'trik', is parsed by the function within the library. An attacker can convince a user to open a video to trigger this vulnerability.

• CWE-680Integer Overflow to Buffer OverflowThe product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
• CWE-681Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.