oss-security - CVE Request -- gstreamer-plugins-good

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1232708798.3220.16.camel@dhcp-lab-164.englab.brq.redhat.com>
Date: Fri, 23 Jan 2009 12:06:37 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com
Subject: CVE Request -- gstreamer-plugins-good

Hello Steve,

  recently the following gstreamer-plugins-good 
related multiple heap-based buffer overflows and
one an array index out of bounds vulnerability
has been reported in the GStreamers demuxer
responsible for demuxing QuickTime *.mov files
into raw or compressed audio/video files.

References:
http://trapkit.de/advisories/TKADV2009-003.txt [1]
http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53
https://bugzilla.redhat.com/show_bug.cgi?id=481267

Affected gstreamer-plugins-good versions:
=========================================
   all prior to latest upstream 0.10.12 version  (all three issues -- "qtdemux_parse_samples", "duration" and "mark_keyframes")

Affected gstreamer-plugins versions:
====================================
  gstreamer-plugins-0.8.5-1.EL.1.i386 (only the "duration" heap based buffer overflow vulnerability -- (vuln #3) in [1].

Steve, could you please allocate a new CVE id/ids for this issue/issues?

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.