CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

multimedia/gpac26.07.0

Framework for processing and streaming content

7
unaddressed
0
VuXML only, still affected
0
fixed
Maintainer
olivier@FreeBSD.org
Packages
gpac 26.07.0
Upstream
up to date
CPE
gpac:gpac
WWW
https://gpac.io/
Links
cgit · VuXML

Unaddressed (7) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 2026.04.01 would fix 4 of 7 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 2022.04.12 2 · 2026.03.17 3 · 2026.04.01 4
CVE-2022-293397.52022-05-05In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed…
CVE-2022-293407.52022-05-05GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gf_isom_parse_movie_boxes_internal due to improper return value handling of GF_SKIP_B…
CVE-2026-795136.52026-09-09A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Servi…
CVE-2026-795146.52026-09-09An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP …
CVE-2026-795226.52026-09-09An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a cr…
CVE-2026-331445.82026-03-20GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability…
CVE-2026-391035.52026-05-05Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (7)

Olivier Cochard (olivier) · 26.07.0
multimedia/gpac: update to 26.07.0

Sponsored by:	Netflix
63f7c885bd
Olivier Cochard (olivier) · 26.02.0_1
multimedia/gpac: Remove procfs dependency

PR:		292600
Reported by:	Ross Williams <ross@ross-williams.net>
Sponsored by:	Netflix
29cce52534
Olivier Cochard (olivier) · 26.02.0
multimedia/gpac: update to 26.02.0

Sponsored by:	Netflix
3211803503
Olivier Cochard (olivier) · 2.4.0_1
multimedia/gpac: Fix some dependencies

PR:		292600
Reported by:	fuz
Sponsored by:	Netflix
7dff43ddcd
Robert Clausecker (fuz) · 2.4.0_1
multimedia/gpac: enable pic everywhere

This fixes the build on arm64 for example.

Approved by:	portmgr (build fix blanket)
e83a9b0fb7
Piotr Kubaj (pkubaj) · 2.4.0
multimedia/gpac: fix build on powerpc64le

ld: error: relocation R_PPC64_TOC16_LO cannot be used against symbol 'gf_sg_handle_dom_event'; recompile with -fPIC
>>> defined in scenegraph/dom_events.o
>>> referenced by dom_events.c
>>>               scenegraph/dom_events.o:(gf_dom_listener_build_ex)

ld: error: relocation R_PPC64_TOC16_LO cannot be used against symbol 'gf_sc_on_event'; recompile with -fPIC
>>> defined in compositor/compositor.o
>>> referenced by compositor.c
>>>               compositor/compositor.o:(gf_sc_load)

ld: error: relocation R_PPC64_TOC16_LO cannot be used against symbol 'gf_scene_get_time'; recompile with -fPIC
>>> defined in compositor/scene.o
>>> referenced by scene.c
>>>               compositor/scene.o:(gf_scene_new)
cc: error: linker command failed with exit code 1 (use -v to see invocation)
2ab68faea3
Olivier Cochard (olivier) · 2.4.0
multimedia/gpac: merge sub-ports and update to 2.4.0

Consolidate gpac, mp4box and library into a single port as the upstream build
system does not easily support splitting applications from the library.

Sponsored by:	Netflix
2f969e9395