CVE-2022-1925: Integer Overflow
First published: Tue Jul 19 2022(Updated: )
DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gstreamer Project Gstreamer | <1.20.3 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| debian/gst-plugins-good1.0 | <=1.14.4-1+deb10u1 | 1.14.4-1+deb10u3 1.18.4-2+deb11u2 1.22.0-5+deb12u1 1.22.6-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225
- https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html
- https://www.debian.org/security/2022/dsa-5204
- https://gstreamer.freedesktop.org/security/sa-2022-0002.html
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ad6012159acf18c6b5c0f4edf037e8c9a2dbc966
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/fafb028196c78062892261d4e042e646ef8e518b
- https://security-tracker.debian.org/tracker/CVE-2022-1925
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-1925.
What is the severity of CVE-2022-1925?
CVE-2022-1925 has a severity rating of 7.8 (high).
What is the affected software?
The affected software includes Gstreamer Project Gstreamer versions up to and excluding 1.20.3, Debian Debian Linux version 10.0, and Debian Debian Linux version 11.0.
How does CVE-2022-1925 affect Gstreamer?
CVE-2022-1925 is a DOS vulnerability that can potentially lead to a heap overwrite in mkv demuxing using HEADERSTRIP decompression in Gstreamer.
How do I fix CVE-2022-1925?
To fix CVE-2022-1925, update to Gstreamer version 1.20.3 or later, or apply the appropriate security fixes provided by the Debian project.
- collector/nvd-index
- collector/security-tracker-debian
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/references
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/gstreamer project
- canonical/gstreamer project gstreamer
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- package-manager/debian