oss-security - CVE Request -- gstreamer-plugins-good

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Fri, 23 Jan 2009 12:06:37 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com
Subject: CVE Request -- gstreamer-plugins-good

Hello Steve,

  recently the following gstreamer-plugins-good 
related multiple heap-based buffer overflows and
one an array index out of bounds vulnerability
has been reported in the GStreamers demuxer
responsible for demuxing QuickTime *.mov files
into raw or compressed audio/video files.

References:
http://trapkit.de/advisories/TKADV2009-003.txt [1]
http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53
https://bugzilla.redhat.com/show_bug.cgi?id=481267

Affected gstreamer-plugins-good versions:
=========================================
   all prior to latest upstream 0.10.12 version  (all three issues -- "qtdemux_parse_samples", "duration" and "mark_keyframes")

Affected gstreamer-plugins versions:
====================================
  gstreamer-plugins-0.8.5-1.EL.1.i386 (only the "duration" heap based buffer overflow vulnerability -- (vuln #3) in [1].

Steve, could you please allocate a new CVE id/ids for this issue/issues?

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.