DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemuxinflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite.
DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gstmatroskadecompressdata function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.
DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gstmatroskadecompressdata function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
Integer overflow in matroskademux element in gstmatroskademuxaddwvpkheader function which allows a heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap overwrite.
Integer overflow in avidemux element in gstavidemuxinvert function which allows a heap overwrite while parsing avi files. Potential for arbitrary code execution through heap overwrite.
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
The gstasfdemuxprocessextstreamprops function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.
The gstasfdemuxprocessextcontentdesc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
A floating point exception was found in gstriffcreateaudiocaps.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777525
Upstream patch:
https://github.com/GStreamer/gst-plugins-base/commit/5d505d108800cef210f67dcfed2801ba36beac2a
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
A use-after-free vulnerability was found in gstminiobjectunref / gsttaglistunref / gstmxfdemuxupdateessencetracks.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777503
Upstream patch:
https://github.com/GStreamer/gst-plugins-bad/commit/08723e6
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
An out-of-bounds heap read in htmlcontexthandleelement was found.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777502
Upstream patch:
https://github.com/GStreamer/gst-plugins-base/commit/d894c19
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
An out-of-bounds heap read was found in qtdemuxparsesamples that can be triggered by specially crafted file.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777469
Upstream patches:
https://github.com/GStreamer/gst-plugins-good/commit/99d5d75 https://github.com/GStreamer/gst-plugins-good/commit/1ffef8b
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
An out-of-bounds heap read was found gstavidemuxparsencdt.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777500
Upstream patch:
https://github.com/GStreamer/gst-plugins-good/commit/32d9f3c
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
An out-of-bounds read in gstdatetimenewfromiso8601string() was found that can be triggered by malformed datetime string.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777263
Upstream patch:
https://github.com/GStreamer/gstreamer/commit/9398b7f1a75b38844ae7050b5a7967e4cdebe24f
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
An endless recursion leading to a stack overflow in gstriffcreateaudiocaps was found.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777265
Upstream patch:
https://github.com/GStreamer/gst-plugins-base/commit/ef55c8a
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
A floating point exception was found in gstriffcreateaudiocaps that can be triggered by specially crafted file.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777262
Upstream patch:
https://github.com/GStreamer/gst-plugins-base/commit/81d3ba3fa212bb25fe2ac661993887c4b69af6f1
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
Invalid memory read and possible buffer overflows were found in PSM parser.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777957
Upstream patch:
https://github.com/GStreamer/gst-plugins-bad/commit/948b87bf1514de
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
An invalid memory read was found in gstavidemuxparsencdt.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=777532
Upstream patch:
https://github.com/GStreamer/gst-plugins-good/commit/4f47835
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
An out-of-bounds read in qtdemuxtagaddstrfull was found that can be triggered by specially crafted file.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=775451
Upstream patch:
https://github.com/GStreamer/gst-plugins-good/commit/d0949baf3dadea6021d54abef6802fed5a06af75
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
An invalid memory read in gstaacparsesinksetcaps was found that can be triggered by specially crafted file.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=775450
Upstream patch:
https://github.com/GStreamer/gst-plugins-good/commit/87a2c140ca54c5128093377e9b25a5c24b346727
CVE assignment:
http://seclists.org/oss-sec/2017/q1/284
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
A missing initialization of allocated heap memory for render canvas leads to information leak.
CVE assignment:
http://seclists.org/oss-sec/2016/q4/462
External References:
https://scarybeastsecurity.blogspot.sk/2016/11/0day-poc-risky-design-decisions-in.html
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
Integer overflow in the gstvorbistagaddcoverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.