GStreamer vulnerabilities

In GStreamer's gst-plugins-good, a heap-based out-of-bounds read of 4 bytes occurs when parsing FLAC audio stream headers embedded in Matroska or WebM container files. A boundary check does not account for the full size of the copied data, allowing a small read past the end of the allocated buffer. An attacker can exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it.

Multiple use-after-free vulnerabilities in the gst_mini_object_unref, gst_tag_list_unref, and gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags.

The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.

The gst_date_time_new_from_iso8601_string function in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via a malformed datetime string, leading to an out-of-bounds heap read.

The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.

The vmnc decoder in gstreamer does not initialize the render canvas, allowing remote attackers to obtain sensitive information. This is demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.

Integer overflow in the vmnc decoder in gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.

Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before version 1.10.2 allows remote attackers to have unspecified impact via a crafted file, leading to an out-of-bounds read.

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.

Use-After-Free vulnerability in GStreamer rtpsbcdepay allows remote code execution. Lack of validating object existence before operations leads to use-after-free. An attacker can leverage this to execute code in the context of the current process.

Heap-based buffer overflow in GStreamer PNG file parsing allows remote code execution. Lack of proper length validation before copying data to heap buffer leads to overflow. User interaction is required, such as visiting a malicious page or opening a malicious file.

Stack-based buffer overflow in GStreamer OGG file parsing allows remote code execution. Lack of proper length validation before copying data to stack buffer leads to overflow. User interaction is required, such as visiting a malicious page or opening a malicious file.

Heap-based buffer overflow in GStreamer MRF file parsing allows remote code execution. Lack of proper length validation before copying data to heap buffer leads to overflow. User interaction is required, such as visiting a malicious page or opening a malicious file.

Out-of-bounds write in GStreamer MRF file parsing allows remote code execution. Lack of proper validation of user-supplied data leads to write past the end of an allocated buffer. User interaction is required, such as visiting a malicious page or opening a malicious file.

In GStreamer gst-plugins-good (avidemux), in gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service).

In GStreamer gst-plugins-good (avidemux), when parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue.

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.

Vulnerability in GStreamer qtdemux allows a remote attacker to execute arbitrary code via a stack-based buffer overflow when parsing UncompressedFrameConfigBox structures. User interaction with the library is required.

A stack buffer overflow vulnerability exists in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is copied into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN, causing a stack buffer overflow and process crash.

A heap buffer overflow vulnerability exists in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function has an inverted boolean condition, accepting SDP offers without the required a=fingerprint attribute and rejecting those with it. An attacker can manipulate WebRTC signaling to bypass DTLS certificate fingerprint binding.

In the GStreamer library (gst-plugins-bad), processing a crafted H.264 video file with malformed MVC or SVC extension slice NAL units triggers a one-byte heap out-of-bounds read. The flaw occurs when the parser checks slice boundary information without verifying that the NAL unit contains enough data beyond the extension header.

A flaw was found in the GStreamer gst-plugins-bad package where processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator causes an out-of-bounds read of up to 8 bytes from adjacent memory. An attacker can exploit this by providing a malicious video file or stream, leading to memory content leakage through video metadata.

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. An integer overflow in buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation, leading to heap memory corruption when decoded audio samples are written beyond the allocated buffer. This affects both 32-bit and 64-bit systems as the arithmetic is performed in 32-bit integers before promotion to the allocation size type.

In GStreamer's RealMedia demuxer (gst-plugins-ugly), offsets are not validated when processing FILEINFO metadata, and the element count is attacker-controlled. This can cause infinite loops, crashes, or adjacent memory reads.

Vulnerability in the RealMedia demuxer of GStreamer (gst-plugins-ugly) causes an out-of-bounds read when processing a malicious .rm file. The attack can lead to application crash or limited information disclosure.

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads.

A heap buffer overflow vulnerability was found in GStreamer's librfb library. Incorrect rectangle bounds checking allows a malicious VNC server to send a rectangle extending beyond the framebuffer, leading to an out-of-bounds heap write.

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data, leading to a read beyond the input buffer.

A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.

A vulnerability in the H.266 codec parser of GStreamer allows remote code execution via an out-of-bounds write. The issue occurs during APS unit processing due to missing user-supplied data validation.

A heap-based buffer overflow vulnerability in GStreamer (rtpqdm2depay) allows remote code execution via crafted X-QDM RTP payloads. The lack of proper length validation before copying user data to a heap buffer leads to overflow.

Integer underflow vulnerability in GStreamer H.266 codec parser allows remote code execution. The flaw exists in picture partition parsing due to insufficient validation of user-supplied data.

A vulnerability in GStreamer allows remote code execution via an out-of-bounds write during processing of X-QDM RTP payload elements. The flaw exists in the rtpqdm2depay function when parsing the packetid element, where missing validation leads to a write past the end of an allocated array.

A heap-based buffer overflow vulnerability in the GStreamer JPEG parser allows remote code execution. The flaw exists in Huffman table processing due to missing validation of user-supplied data length before copying to a fixed-length heap buffer.

A vulnerability in the H.266 codec parser in GStreamer allows remote code execution via a stack-based buffer overflow. The issue stems from missing validation of user-supplied data length before copying to a fixed stack buffer.

A vulnerability in GStreamer's handling of DVB subtitles allows remote code execution via an out-of-bounds write. The issue stems from missing validation of user-supplied coordinates.

A vulnerability in the RealMedia demuxer of GStreamer allows remote code execution due to an out-of-bounds write. The issue stems from insufficient validation of user-supplied data during video packet processing.

Integer overflow in GStreamer's handling of palette data in AVI files allows remote code execution. Lack of user-supplied data validation leads to memory corruption.

A heap-based buffer overflow vulnerability has been discovered in the GStreamer ASF demuxer, allowing remote code execution. The issue stems from improper validation of user-supplied data length before copying it to a fixed-length heap buffer. An attacker can exploit this flaw to execute arbitrary code in the context of the current process.