Vulnerability · Published Apr 5, 2020 · Assigned by mitre

CVE-2020-11558

Critical 9.8

In plain English

A critical-severity security flaw in the ccextractor package (Ubuntu). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)1.5%top 25.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_movie_boxes.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	ccextractor	no fix listed	UBUNTU-CVE-2020-11558
Ubuntu:24.04:LTS	ccextractor	no fix listed	UBUNTU-CVE-2020-11558

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gpac/gpac/commit/6063b1a011c3f80cee25daade18154e15e4c058c x_refsource_MISC
https://github.com/gpac/gpac/issues/1440 x_refsource_MISC