{"id":"CVE-2018-13006","details":"An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.","modified":"2026-08-07T14:49:29.056070Z","published":"2018-06-29T14:29:00.433Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"18.10"},{"last_affected":"18.10"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}]}]},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00024.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3926-1/"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"440d475f133038824dab08292b2e592ecd0e10b4"},{"last_affected":"440d475f133038824dab08292b2e592ecd0e10b4"},{"fixed":"bceb03fd2be95097a7b409ea59914f332fb6bc86"}],"database_specific":{"cpe":"cpe:2.3:a:gpac:gpac:0.7.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.7.1"},{"last_affected":"0.7.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.7.1","v0.7.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-13006.json","vanir_signatures_modified":"2026-08-07T14:49:29Z","vanir_signatures":[{"source":"https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86","target":{"file":"src/isomedia/box_dump.c","function":"hdlr_dump"},"deprecated":false,"digest":{"function_hash":"43054822562971889790112649065050738269","length":700},"id":"CVE-2018-13006-48037c0a","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86","target":{"file":"src/isomedia/box_dump.c"},"deprecated":false,"digest":{"line_hashes":["240129264460215101760777230888128164565","92702156625880302266939257319649640893","106025944208538254204216118738768950364","291361657713469353512677670250634893467","114828400390421047261539912847425380491","180158920246265982655196955164224034646","46529492494311210502089748160008866082","328792758787200467428256411222292138309","225418848381896315121417901204764322795","316273335466316768894293464072395772112","272981713739917107403282266976021755545","263228647726209966753406310595928825832","162978353272406893293034852260673864929","212408701237226215133420827343398066547","147355063569052367289533551592335104419","78353194541589929820848852692231624477","88898945021634436099969858195214715329","290255864161061932017116687271735605364","196715427663184130465026503108250380005","323943812714742087718554492099001672739","241382284308687866851092548279345156715","20348201306363799519440654524283513057","116683227579297135907438582119699371976","332049996018732859893380018854157529767","181927952357989742120082240421832220312","197206810468105811996021239872540502519"],"threshold":0.9},"id":"CVE-2018-13006-6788df8b","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["225930566936052243641962346314426053849","72973447274602359087766500130082130622","114637650171971459425082135552424725701","226713972853355409738971654588282762732"],"threshold":0.9},"id":"CVE-2018-13006-754b92bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86","target":{"file":"src/isomedia/box_code_base.c"}},{"target":{"file":"include/gpac/internal/isomedia_dev.h"},"deprecated":false,"digest":{"line_hashes":["44569583039775634638106699721267891144","44605539196149009950683430579838645942","203837620228269494667698691868752906388","333379221623619907573134082483232062106"],"threshold":0.9},"id":"CVE-2018-13006-ab7a5a36","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86"},{"digest":{"length":1039,"function_hash":"188650703219858837821397659744260795143"},"id":"CVE-2018-13006-ef8f3454","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86","target":{"file":"src/isomedia/box_code_base.c","function":"urn_Read"},"deprecated":false}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}