oss-sec mailing list archives
CVE Request -- (sor of urgent) gstreamer-plugins, gstreamer-plugins-good (repost)
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Thu, 29 Jan 2009 11:25:48 +0100
On Fri, 2009-01-23 at 12:06 +0100, Jan Lieskovsky wrote:
Hello Steve, recently the following gstreamer-plugins-good related multiple heap-based buffer overflows and one an array index out of bounds vulnerability has been reported in the GStreamers demuxer responsible for demuxing QuickTime *.mov files into raw or compressed audio/video files. References: http://trapkit.de/advisories/TKADV2009-003.txt [1] http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53 https://bugzilla.redhat.com/show_bug.cgi?id=481267 Affected gstreamer-plugins-good versions: ========================================= all prior to latest upstream 0.10.12 version (all three issues -- "qtdemux_parse_samples", "duration" and "mark_keyframes") Affected gstreamer-plugins versions: ==================================== gstreamer-plugins-0.8.5-1.EL.1.i386 (only the "duration" heap based buffer overflow vulnerability -- (vuln #3) in [1]. Steve, could you please allocate a new CVE id/ids for this issue/issues? Thanks, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request -- gstreamer-plugins-good Jan Lieskovsky (Jan 23)
- CVE Request -- (sor of urgent) gstreamer-plugins, gstreamer-plugins-good (repost) Jan Lieskovsky (Jan 29)