CVE-2021-3185: Buffer Overflow
A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.
Other sources
A flaw was found in the gstreamer parsing code in the function gsth264sliceparsedecrefpicmarking. An attacker able to trigger this section of code can cause a buffer overflow possibly overflowing the element on the stack leading to memory corruption.
Upstream fix: https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/11353b3f6e2f047cc37483d21e6a37ae558896bc
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gst-plugins-badto a version that resolves this vulnerability.Fixed in 1.18.1 - Upgrade
Upgrade
gstreamer gst-plugins-bad (gstreamer h264 / h264 header parsing)to a version that resolves this vulnerability.Fixed in v1.18.1Patch 11353b3f6e2f047cc37483d21e6a37ae558896bc
Event History
Frequently Asked Questions
What is CVE-2021-3185?
CVE-2021-3185 is a vulnerability found in the gstreamer h264 component of gst-plugins-bad before v1.18.1.
What is the impact of CVE-2021-3185?
The impact of CVE-2021-3185 is stack smashing, memory corruption, and possible code execution.
What software is affected by CVE-2021-3185?
The software affected by CVE-2021-3185 includes gst-plugins-bad before v1.18.1 from Red Hat and Gst-plugins-bad from the Freedesktop project.
What is the severity of CVE-2021-3185?
The severity of CVE-2021-3185 is critical with a CVSS score of 9.8.
How do I fix CVE-2021-3185?
To fix CVE-2021-3185, update gst-plugins-bad to version 1.18.1 or newer.