Bug 483736 (CVE-2009-0386) - CVE-2009-0386 gstreamer-plugins-good: heap-based buffer overflow while parsing malformed QuickTime media files via crafted Composition Time To Sample (aka ctts) atom data
Summary: CVE-2009-0386 gstreamer-plugins-good: heap-based buffer overflow while parsin...
Status: CLOSED ERRATA
Alias: CVE-2009-0386
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://trapkit.de/advisories/TKADV200...
Whiteboard: public=20090122,reported=20090123,imp...
Keywords: Security
Depends On: 483220 483221 833907
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-02-03 13:00 UTC by Jan Lieskovsky
Modified: 2016-03-04 12:34 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-02-26 09:13:15 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:0271 normal SHIPPED_LIVE Important: gstreamer-plugins-good security update 2009-02-06 12:42:09 UTC

Description Jan Lieskovsky 2009-02-03 13:00:03 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0386 to
the following vulnerability:

Heap-based buffer overflow in the qtdemux_parse_samples function in
gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka
gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers
to execute arbitrary code via crafted Composition Time To Sample
(ctts) atom data in a malformed QuickTime media .mov file.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0386
http://www.securityfocus.com/archive/1/archive/1/500317/100/0/threaded
http://www.openwall.com/lists/oss-security/2009/01/29/3
http://trapkit.de/advisories/TKADV2009-003.txt
http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53
http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html
http://www.securityfocus.com/bid/33405
http://www.frsirt.com/english/advisories/2009/0225
http://secunia.com/advisories/33650

Comment 1 Fedora Update System 2009-02-24 20:41:53 UTC
gstreamer-plugins-good-0.10.8-10.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 2 Fedora Update System 2009-02-24 20:57:02 UTC
gstreamer-plugins-good-0.10.13-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.