GStreamer
open source multimedia framework
Home
Features
News
Annual Conference
Planet (Blogs)
Download
Applications
Security Center
GitLab
Developers
Documentation
Mailing Lists
Forum
File a Bug
Artwork
@gstreamer on Twitter
@gstreamer on Mastodon
#gstreamer on Matrix

Security Advisory 2023-0002 (ZDI-CAN-20968) (CVE-2023-37328)

Summary Heap overwrite in subtitle parsing
Date 2023-06-20 18:00
Affected Versions GStreamer gst-plugins-base 1.x < 1.22.4, 1.x < 1.20.7, 0.10.x
ID GStreamer-SA-2023-0002
ZDI-CAN-20968
CVE-2023-37328

Details

Heap-based buffer overflow in the subparse subtitle parser when handling certain SRT subtitle files in GStreamer versions before 1.22.4 / 1.20.7.

Impact

It is possible for a malicious third party to trigger a crash in the application, and possibly also effect code execution through heap manipulation.

Threat mitigation

Workarounds

Solution

The gst-plugins-base 1.22.4 / 1.20.7 releases address the issue. People using older branches of GStreamer should apply the patch and recompile.

References

The GStreamer project

CVE Database Entries

GStreamer 1.22.4 release

GStreamer 1.20.7 release

Patches


Report a problem on this page.