==========================================================================
Ubuntu Security Notice USN-3926-1
March 29, 2019

gpac vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

GPAC could be made to crash or run programs as your login if it
opened a specially crafted file.

Software Description:
– gpac: GPAC Project on Advanced Content

Details:

It was discovered that the GPAC MP4Box utility incorrectly handled certain
memory operations. If an user or automated system were tricked into opening a
specially crafted MP4 file, a remote attacker could use this issue to cause
MP4Box to crash, resulting in a denial of service, or possibly execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
gpac 0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1
gpac-modules-base 0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1
libgpac4 0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1

Ubuntu 18.04 LTS:
gpac 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1
gpac-modules-base 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1
libgpac4 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1

Ubuntu 16.04 LTS:
gpac 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1
gpac-modules-base 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1
libgpac4 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3926-1
CVE-2018-1000100, CVE-2018-13005, CVE-2018-13006, CVE-2018-20760,
CVE-2018-20761, CVE-2018-20762, CVE-2018-20763, CVE-2018-7752

Package Information:
https://launchpad.net/ubuntu/+source/gpac/0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1
https://launchpad.net/ubuntu/+source/gpac/0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1
https://launchpad.net/ubuntu/+source/gpac/0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1
—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAlyeZREACgkQbUp5kL3i
zGakxA/+IoOjvwO8vOzMEk6QV9GO5wn3ukjqTTvnJbxc7bEzO9xACoTDpXsrH8el
DNmyLh5Gz/7c4GxQK8w2sZQxV3zIU6TP9yIKwERLkjnZYuXbPQUVcMn7S01jkwj6
36j2LqifubkW7Cvr5294FU9nkTuBzDJzhN5GBMLfJf+4+KLE7cYUAbkxICrDsGK/
GR7KngxwH+N/DmkpJR2cYAEtT7xDLLZzJu4aJUearVxwVJ2tptyvnA9SPPzdn+gh
uQGXJMCEek64n8PnaAtFZqx/b+M67wFzLgGVnQv9xLR4hc9RFFL9wgfhPWrna6wR
R9lCjmxfXkZNvbbFJzne4VKUsqBpYcfD28ksfstiwWbPAywgvHIpksXfnHpycGXl
0vXVreeHQfsoim69inZZTqZwn5rCa2M7IPElV2rKrwrjptcSkLf0Nh445C8OXxN4
jALrREYas61BofTuSBK0g7W1M7dCD0Z9tdVsmr6Qmc46EV2Jgd80U1v5nEo1q+OV
F2ddA3rTLk9f8ZAXc3jGTtrPRttgaopqUJRQAlptAr1P6445BsLYegtTNQCcfyyF
YhkVvwFKOFDiP0/07pOtWxXzzq/6cCv2/Lj2wB4F8qBKGGPsULmL+4CxQzjJzaVS
Dx/gYiUArYoUAZcncRrxNu33ux7QAmiTaAm+/p2k+dC/TcNCb+g=
=7mph
—–END PGP SIGNATURE—–
—