CVE-2009-0387: Buffer Overflow

Published Feb 2, 2009

Updated

Array index error in the qtdemuxparsesamples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes."

Affected Software

4 affected components

GStreamer Good Plug-ins=0.10.9

GStreamer Good Plug-ins=0.10.10

GStreamer Good Plug-ins=0.10.11

GStreamer Plug-ins=0.8.5

Remediation

Patch Available

http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html

Event History

Feb 2, 2009

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·07:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0387?

CVE-2009-0387 has a severity rating that indicates it can lead to denial of service and potentially allow arbitrary code execution.

How do I fix CVE-2009-0387?

To fix CVE-2009-0387, users should update to GStreamer Good Plug-ins version 0.10.12 or later.

Which versions are affected by CVE-2009-0387?

CVE-2009-0387 affects GStreamer Good Plug-ins versions 0.10.9 through 0.10.11 and GStreamer Plug-ins version 0.8.5.

What type of vulnerability is CVE-2009-0387?

CVE-2009-0387 is an array index error that can cause application crashes and may allow arbitrary code execution.

Is it safe to use GStreamer versions prior to 0.10.12 with CVE-2009-0387?

Using GStreamer versions prior to 0.10.12 is not safe due to the risks associated with CVE-2009-0387.