CVE-2009-0397 Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka gstreame...
HighCVSS 9.3
EPSS 7.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka gstreamer-plugins) 0.8.5, might allow remote attackers to execute arbitrary code via crafted Time-to-sample (aka stts) atom data in a malformed QuickTime media .mov file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi gstreamer-plugins(PyPI) | <= 0.10.9 | No fix listed |
| pypi gstreamer-plugins(PyPI) | <= 0.10.10 | No fix listed |
| pypi gstreamer-plugins(PyPI) | <= 0.10.11 | No fix listed |
| pypi gstreamer-plugins(PyPI) | <= 0.8.5 | No fix listed |
| GStreamer good plug-ins | = 0.10.9 | No fix listed |
| GStreamer good plug-ins | = 0.10.10 | No fix listed |
| GStreamer good plug-ins | = 0.10.11 | No fix listed |
| GStreamer plug-ins | = 0.8.5 | No fix listed |
References
- cgit.freedesktop.org
- gstreamer.freedesktop.org
- SUSE-SR:2009:005 vendor-advisory
- support.avaya.com
- RHSA-2009:0270 vendor-advisory
- RHSA-2009:0271 vendor-advisory
- 20090122 [TKADV2009-003] GStreamer Heap Overflow and Array Index out of Bounds Vulnerabilities mailing-list
- gstreamer-qtdemuxparse-bo(48555) vdb-entry
- oval:org.mitre.oval:def:9942 signature vdb-entry
- 33650 third-party-advisory vendor-advisory
- 33815 third-party-advisory vendor-advisory
- 33830 third-party-advisory vendor-advisory
- 34336 third-party-advisory vendor-advisory
- 35777 third-party-advisory vendor-advisory
- GLSA-200907-11 vendor-advisory
- MDVSA-2009:035 vendor-advisory
- USN-736-1 vendor-advisory
- ADV-2009-0225 vdb-entry vendor-advisory
- bugzilla.redhat.com issue-tracking
- 33405 patch vdb-entry
- trapkit.de exploit
- [oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version) exploit mailing-list