GStreamer
open source multimedia framework

GStreamer Spring Hackfest 2025

16-18 May 2025 ยท Nice, France

Join us!
Home
Features
News
Annual Conference
Planet (Blogs)
Download
Applications
Security Center
GitLab
Developers
Documentation
Forum
File a Bug
Artwork
Follow us on Bluesky
Follow us on Mastodon
Chat with us on Matrix

Security Advisory 2023-0001 (ZDI-CAN-20775, CVE-2023-37327)

Summary Integer overflow leading to heap overwrite in FLAC image tag handling
Date 2023-06-20 18:00
Affected Versions GStreamer gst-plugins-good 1.x < 1.22.4, 1.x < 1.20.7, 0.10.x
IDs GStreamer-SA-2023-0001
ZDI-CAN-20775
CVE-2023-37327

Details

Heap-based buffer overflow in the FLAC parser when handling malformed image tags in GStreamer versions before 1.22.4 / 1.20.7.

Impact

It is possible for a malicious third party to trigger a crash in the application, and possibly also effect code execution through heap manipulation.

Solution

The gst-plugins-good 1.22.4 / 1.20.7 releases address the issue. People using older branches of GStreamer should apply the patch and recompile.

References

The GStreamer project

CVE Database Entries

GStreamer 1.22.4 release

GStreamer 1.20.7 release

Patches


Report a problem on this page.