CVE-2009-0586

Description

Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

2.819

Associated Vulnerability

Vulnerability	OS Platform
(RHSA-2009:0352) Moderate: gstreamer-plugins-base security update gstreamer-plugins-base-0.10.20-3.0.1.el5_3.i386.rpm	Linux
(RHSA-2009:0352) Moderate: gstreamer-plugins-base security update gstreamer-plugins-base-0.10.20-3.0.1.el5_3.x86_64.rpm	Linux
(RHSA-2009:0352) Moderate: gstreamer-plugins-base security update gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.i386.rpm	Linux
(RHSA-2009:0352) Moderate: gstreamer-plugins-base security update gstreamer-plugins-base-devel-0.10.20-3.0.1.el5_3.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234