[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <1233224748.3218.1.camel@dhcp-lab-164.englab.brq.redhat.com>
Date: Thu, 29 Jan 2009 11:25:48 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com
Subject: CVE Request -- (sor of urgent) gstreamer-plugins,
gstreamer-plugins-good (repost)
On Fri, 2009-01-23 at 12:06 +0100, Jan Lieskovsky wrote:
> Hello Steve,
>
> recently the following gstreamer-plugins-good
> related multiple heap-based buffer overflows and
> one an array index out of bounds vulnerability
> has been reported in the GStreamers demuxer
> responsible for demuxing QuickTime *.mov files
> into raw or compressed audio/video files.
>
> References:
> http://trapkit.de/advisories/TKADV2009-003.txt [1]
> http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53
> https://bugzilla.redhat.com/show_bug.cgi?id=481267
>
>
> Affected gstreamer-plugins-good versions:
> =========================================
> all prior to latest upstream 0.10.12 version (all three issues -- "qtdemux_parse_samples", "duration" and "mark_keyframes")
>
> Affected gstreamer-plugins versions:
> ====================================
> gstreamer-plugins-0.8.5-1.EL.1.i386 (only the "duration" heap based buffer overflow vulnerability -- (vuln #3) in [1].
>
> Steve, could you please allocate a new CVE id/ids for this issue/issues?
>
> Thanks, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
