PT-2021-2237 · Gstreamer+3 · Gst-Plugins-Bad+3
Wade Mealing
·
Published
2020-10-28
·
Updated
2022-09-30
·
CVE-2021-3185
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
gst-plugins-bad versions prior to 1.18.1
Description
A flaw was found in the gstreamer h264 component where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution. The vulnerability is related to the
gst h264 slice parse dec ref pic marking function and is associated with a buffer overflow in memory, which could allow a remote attacker to execute arbitrary code or cause a denial of service.Recommendations
For versions prior to 1.18.1, update to version 1.18.1 or later to resolve the issue. As a temporary workaround, consider disabling the
gst h264 slice parse dec ref pic marking function until a patch is available. Restrict access to the gstreamer h264 component to minimize the risk of exploitation.Fix
Buffer Overflow
Memory Corruption
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Suse
Gst-Plugins-Bad