GStreamer
open source multimedia framework
Home
Features
News
Annual Conference
Planet (Blogs)
Download
Applications
Security Center
GitLab
Developers
Documentation
Forum
File a Bug
Artwork
@gstreamer on Twitter
@gstreamer on Mastodon
#gstreamer on Matrix

Security Advisory 2023-0001 (ZDI-CAN-20775) (CVE-2023-37327)

Summary Integer overflow leading to heap overwrite in FLAC image tag handling
Date 2023-06-20 18:00
Affected Versions GStreamer gst-plugins-good 1.x < 1.22.4, 1.x < 1.20.7, 0.10.x
ID GStreamer-SA-2023-0001
ZDI-CAN-20775
CVE-2023-37327

Details

Heap-based buffer overflow in the FLAC parser when handling malformed image tags in GStreamer versions before 1.22.4 / 1.20.7.

Impact

It is possible for a malicious third party to trigger a crash in the application, and possibly also effect code execution through heap manipulation.

Threat mitigation

Workarounds

Solution

The gst-plugins-good 1.22.4 / 1.20.7 releases address the issue. People using older branches of GStreamer should apply the patch and recompile.

References

The GStreamer project

CVE Database Entries

GStreamer 1.22.4 release

GStreamer 1.20.7 release

Patches


Report a problem on this page.