p PatchFirst

PatchFirst · Latest vulnerabilities

gst-plugins-bad1.0 vulnerabilities · Page 2

Vulnerabilities published for gst-plugins-bad1.0 in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 37

  1. CVE-2023-40476

    High · CVSS 8.8EPSS 2.26%Fix available

    GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

    GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H265 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

    gst-plugins-bad1.0Operating systems
    • Update to 1.22.0-4+deb12u2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2023-40475

    High · CVSS 8.8EPSS 2.1%Fix available

    GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability

    GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-21661

    gst-plugins-bad1.0Operating systems
    • Update to 1.22.0-4+deb12u2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2023-40474

    High · CVSS 8.8EPSS 2.1%Fix available

    GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability

    GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-21660

    gst-plugins-bad1.0Operating systems
    • Update to 1.22.0-4+deb12u2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2023-37329

    High · CVSS 8.8EPSS 1.64%Fix available

    GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

    GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of SRT subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20968

    gst-plugins-bad1.0Operating systems
    • Update to 1.22.0-4+deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2017-5843

    High · CVSS 7.5EPSS 3.8%Fix available

    CVE-2017-5843

    Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf.

    gst-plugins-bad1.0Operating systems
    • Update to 1.10.3-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →