REDHAT-BUG-2331719: High severity moonlight vulnerability
GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gstmatroskademuxaddwvpkheader function within matroska-demux.c. When size < 4, the program calls gstbufferunmap with an uninitialized map variable. Then, in the gstmemoryunmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->memunmapfull or mem->allocator->memunmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2331719?
The severity of REDHAT-BUG-2331719 is classified as critical due to the potential for information disclosure and exploitation.
How do I fix REDHAT-BUG-2331719?
To fix REDHAT-BUG-2331719, update GStreamer to version 1.24.10 or later, as patches are provided in the newer releases.
What causes the vulnerability REDHAT-BUG-2331719?
The vulnerability REDHAT-BUG-2331719 is caused by an uninitialized stack variable in the gst_matroska_demux_add_wvpk_header function when the size is less than 4.
Which versions of GStreamer are affected by REDHAT-BUG-2331719?
GStreamer versions up to but not including 1.24.10 are affected by vulnerability REDHAT-BUG-2331719.
What impacts could REDHAT-BUG-2331719 have on affected systems?
Vulnerability REDHAT-BUG-2331719 could lead to application crashes or unintended data exposure from uninitialized memory.