CVE-2009-0397

描述

Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka gstreamer-plugins) 0.8.5, might allow remote attackers to execute arbitrary code via crafted Time-to-sample (aka stts) atom data in a malformed QuickTime media .mov file.

如何修補 CVE-2009-0397

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• PyPI/gstreamer-plugins—未列出修補版本

CVE-2009-0397 正在被利用嗎?

中等 — EPSS 為 7.1%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, <= 0.10.9, <= 0.10.10, <= 0.10.11, <= 0.8.5

參考連結(22)

• ADVISORYsecunia.com/advisories/33650
• ADVISORYsecunia.com/advisories/33815
• ADVISORYsecunia.com/advisories/33830
• ADVISORYsecunia.com/advisories/34336
• ADVISORYsecunia.com/advisories/35777