FaSTTUBe/GST-Tensordecoder-ov_ep
39
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
GST-Tensordecoder-ov_ep/security-advisories/sa-2024-0002.md
Tim-Philipp Müller 95ca7014c8 security-advisories: import from www module 
Ship these also as part of the monorepo, so we can prepare
new advisories as part of the relevant merge requests in
the private gstreamer-security repository.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/7610>
2024-10-04 19:18:45 +00:00

1.6 KiB
Raw Blame History

Security Advisory 2024-0002 (ZDI-CAN-23896, CVE-2024-4453)
Summary Integer overflow in EXIF metadata parser leading to potential heap overwrite
Date 2024-04-29 20:00
Affected Versions GStreamer gst-plugins-base < 1.24.3, gst-plugins-base < 1.22.12
IDs GStreamer-SA-2024-0002
ZDI-CAN-23896
CVE-2024-4453

Details

Heap-based buffer overflow in the EXIF image tag parser when handling certain malformed streams before GStreamer 1.24.3 or 1.22.12.

Impact

It is possible for a malicious third party to trigger a crash in the application, and possibly also effect code execution through heap manipulation.

Solution

The gst-plugins-base 1.24.3 and 1.22.12 releases address the issue. People using older branches of GStreamer should apply the patch and recompile.

References

The GStreamer project

CVE Database Entries

GStreamer releases

1.24 (current stable)

1.22 (old stable)

Patches