Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 23 Jan 2009 12:06:37 +0100
From: Jan Lieskovsky <>
To: "Steven M. Christey" <>
Subject: CVE Request -- gstreamer-plugins-good

Hello Steve,

  recently the following gstreamer-plugins-good 
related multiple heap-based buffer overflows and
one an array index out of bounds vulnerability
has been reported in the GStreamers demuxer
responsible for demuxing QuickTime *.mov files
into raw or compressed audio/video files.

References: [1]

Affected gstreamer-plugins-good versions:
   all prior to latest upstream 0.10.12 version  (all three issues -- "qtdemux_parse_samples", "duration" and "mark_keyframes")

Affected gstreamer-plugins versions:
  gstreamer-plugins-0.8.5-1.EL.1.i386 (only the "duration" heap based buffer overflow vulnerability -- (vuln #3) in [1].

Steve, could you please allocate a new CVE id/ids for this issue/issues?

Thanks, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.