DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-gtk | May 15, 2023 | Jul 19, 2022 |
| Alpine Linux | — | Upgrade gstreamerUpgrade gst-plugins-good | Mar 21, 2024 | Jul 19, 2022 |
| Centos_linux | — | Upgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-gtk-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-qt-debuginfoUpgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-debugsource | May 15, 2023 | Jul 19, 2022 |
| Debian | — | Upgrade gst-plugins-good1.0 | Aug 17, 2022 | Jul 19, 2022 |
| Gentoo Linux | — | Upgrade media-libs/gst-plugins-good. | Sep 23, 2024 | Jul 19, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gstreamer1-plugins-good | Oct 28, 2022 | Jul 19, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade gstreamer1-plugins-good | Aug 18, 2022 | Jul 19, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade gstreamer1-plugins-baseUpgrade gstreamer1-plugins-good | Oct 11, 2022 | Jul 19, 2022 |
| Oracle_linux | — | Upgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good | May 17, 2023 | May 18, 2022 |
| Redhat_linux | — | Upgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-good-qt-debuginfoUpgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-goodNo solution existsUpgrade gstreamer1-plugins-good-gtk-debuginfo | May 15, 2023 | Jul 19, 2022 |
| Suse | — | Upgrade gstreamer-plugins-good-gtkUpgrade gstreamer-0_10-plugins-goodUpgrade gstreamer-plugins-good-docUpgrade gstreamer-plugins-good-32bitUpgrade gstreamer-plugins-good-jack-32bitUpgrade gstreamer-plugins-good-extra-32bitUpgrade gstreamer-plugins-goodUpgrade gstreamer-plugins-good-extraUpgrade gstreamer-plugins-good-qtqmlUpgrade gstreamer-plugins-good-jackUpgrade gstreamer-0_10-plugins-good-langUpgrade gstreamer-plugins-good-lang | Oct 26, 2022 | Jul 19, 2022 |
| Ubuntu | — | Upgrade gstreamer1.0-plugins-goodUpgrade gstreamer1.0-plugins-good (Ubuntu Pro) | Aug 9, 2022 | Jul 19, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 19, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub