GStreamer
open source multimedia framework

GStreamer Conference 2023

25-26 September 2023 · A Coruña, Spain

Registration is open · Lightning Talks can still be submitted · Join us!
Home
Features
News
Annual Conference
Planet (Blogs)
Download
Applications
Security Center
GitLab
Developers
Documentation
Mailing Lists
Forum
File a Bug
Artwork
@gstreamer on Twitter
@gstreamer on Mastodon
#gstreamer on Matrix

Security Advisory 2023-0001 (ZDI-CAN-20775) (CVE-2023-37327)

Summary Integer overflow leading to heap overwrite in FLAC image tag handling
Date 2023-06-20 18:00
Affected Versions GStreamer gst-plugins-good 1.x < 1.22.4, 1.x < 1.20.7, 0.10.x
ID GStreamer-SA-2023-0001
ZDI-CAN-20775
CVE-2023-37327

Details

Heap-based buffer overflow in the FLAC parser when handling malformed image tags in GStreamer versions before 1.22.4 / 1.20.7.

Impact

It is possible for a malicious third party to trigger a crash in the application, and possibly also effect code execution through heap manipulation.

Threat mitigation

Workarounds

Solution

The gst-plugins-good 1.22.4 / 1.20.7 releases address the issue. People using older branches of GStreamer should apply the patch and recompile.

References

The GStreamer project

CVE Database Entries

GStreamer 1.22.4 release

GStreamer 1.20.7 release

Patches


Report a problem on this page.