DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-gtk | May 15, 2023 | Jul 19, 2022 |
| Alpine Linux | — | Upgrade gstreamerUpgrade gst-plugins-good | Mar 21, 2024 | Jul 19, 2022 |
| Centos_linux | — | Upgrade gstreamer1-plugins-good-gtk-debuginfoUpgrade gstreamer1-plugins-good-qt-debuginfoUpgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-debugsource | May 15, 2023 | Jul 19, 2022 |
| Debian | — | Upgrade gst-plugins-good1.0 | Aug 17, 2022 | Jul 19, 2022 |
| Gentoo Linux | — | Upgrade media-libs/gst-plugins-good. | Sep 23, 2024 | Jul 19, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gstreamer1-plugins-good | Oct 28, 2022 | Jul 19, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade gstreamer1-plugins-good | Aug 18, 2022 | Jul 19, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade gstreamer1-plugins-baseUpgrade gstreamer1-plugins-good | Oct 11, 2022 | Jul 19, 2022 |
| Oracle_linux | — | Upgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-gtk | May 17, 2023 | May 18, 2022 |
| Redhat_linux | — | Upgrade gstreamer1-plugins-good-debuginfoNo solution existsUpgrade gstreamer1-plugins-good-qt-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-gtk-debuginfo | May 15, 2023 | Jul 19, 2022 |
| Suse | — | Upgrade gstreamer-plugins-good-jackUpgrade gstreamer-0_10-plugins-goodUpgrade gstreamer-plugins-good-32bitUpgrade gstreamer-plugins-good-extra-32bitUpgrade gstreamer-plugins-good-gtkUpgrade gstreamer-plugins-good-langUpgrade gstreamer-plugins-good-jack-32bitUpgrade gstreamer-0_10-plugins-good-langUpgrade gstreamer-plugins-goodUpgrade gstreamer-plugins-good-extraUpgrade gstreamer-plugins-good-qtqmlUpgrade gstreamer-plugins-good-doc | Oct 26, 2022 | Jul 19, 2022 |
| Ubuntu | — | Upgrade gstreamer1.0-plugins-goodUpgrade gstreamer1.0-plugins-good (Ubuntu Pro) | Aug 9, 2022 | Jul 19, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 19, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub