Date: Thu, 29 Jan 2009 11:25:48 +0100 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> Cc: oss-security@...ts.openwall.com Subject: CVE Request -- (sor of urgent) gstreamer-plugins, gstreamer-plugins-good (repost) On Fri, 2009-01-23 at 12:06 +0100, Jan Lieskovsky wrote: > Hello Steve, > > recently the following gstreamer-plugins-good > related multiple heap-based buffer overflows and > one an array index out of bounds vulnerability > has been reported in the GStreamers demuxer > responsible for demuxing QuickTime *.mov files > into raw or compressed audio/video files. > > References: > http://trapkit.de/advisories/TKADV2009-003.txt  > http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53 > https://bugzilla.redhat.com/show_bug.cgi?id=481267 > > > Affected gstreamer-plugins-good versions: > ========================================= > all prior to latest upstream 0.10.12 version (all three issues -- "qtdemux_parse_samples", "duration" and "mark_keyframes") > > Affected gstreamer-plugins versions: > ==================================== > gstreamer-plugins-0.8.5-1.EL.1.i386 (only the "duration" heap based buffer overflow vulnerability -- (vuln #3) in . > > Steve, could you please allocate a new CVE id/ids for this issue/issues? > > Thanks, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Response Team > > >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.