CVE-2009-0586
published 2009-03-14CVE-2009-0586: Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base)…
PriorityP343high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
5.52%
92.0th percentile
Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| gstreamer | gstreamer | < 0.10.23 | 0.10.23 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GStreamer Base Plugins vulnerability
vendor_ubuntu·2009-03-16
CVE-2009-0586 GStreamer Base Plugins vulnerability
Title: GStreamer Base Plugins vulnerability
Summary: GStreamer Base Plugins vulnerability
It was discovered that the Base64 decoding functions in GStreamer Base
Plugins did not properly handle large images in Vorbis file tags. If a user
were tricked into opening a specially crafted Vorbis file, an attacker
could possibly execute arbitrary code with user privileges.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()
vendor_redhat·2009-03-12·CVSS 7.5
CVE-2009-0586 [HIGH] CWE-190 gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()
gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()
Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.
GHSA
GHSA-x2gq-fc4q-qphg: Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag
ghsa_unreviewed·2022-05-02
CVE-2009-0586 [HIGH] CWE-190 GHSA-x2gq-fc4q-qphg: Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag
Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-0586 gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()
bugzilla·2009-03-03·CVSS 7.5
CVE-2009-0586 [HIGH] CVE-2009-0586 gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()
CVE-2009-0586 gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()
An integer overflow flaw was discovered in the gst_vorbis_tag_add_coverart(). Large COVERART comment tag value can cause memory requirements computation to overflow, resulting in an insufficient memory to be allocated and the allocated buffer overflow when comment tag value is base64-decoded:
gst_vorbis_tag_add_coverart() in gst-libs/gst/tag/gstvorbistag.c:
319
320 img_data = g_try_malloc0 (base64_len * 3 / 4);
321
Discussion:
Note: This problem did not exist in version of gstreamer-plugins-base as shipped in Red Hat Enterprise Linux 5 prior to 5.3. It was only introduced in the gstreamer-plugins-base rebase in 5.3.
---
Created attachment 333999
Upstream patch
---
Public now via upstream git co
Bugzilla
CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
bugzilla·2008-12-05·CVSS 4.6
CVE-2008-4316 [MEDIUM] CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
oCERT team notified us about discovered by Diego Pettenò in glib:
Base64 encoding and decoding functions in glib suffer from vulnerabilities during memory allocations which may result in arbitrary code execution when processing large strings.
g_base64_encode and g_base64_decode allocate memory for their respective behavior using a similar pattern:
ret = g_malloc0 (input_length * 3 / 4);
In g_base64_decode, input_length is typed as a gint and its value is derived directly from a strlen(3) call over an input string. Since the multiplication is evaluated prior to the division, an input_length greater than (UINT_MAX/3), or 1431655765, will wrap resulting in smaller allocation than required. It is also
http://cgit.freedesktop.org/gstreamer/gst-plugins-base/commit/?id=566583e87147f774e7fc4c78b5f7e61d427e40a9http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.htmlhttp://ocert.org/patches/2008-015/gst-plugins-base-CVE-2009-0586.diffhttp://openwall.com/lists/oss-security/2009/03/12/2http://secunia.com/advisories/34335http://secunia.com/advisories/34350http://secunia.com/advisories/35777http://security.gentoo.org/glsa/glsa-200907-11.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:085http://www.ocert.org/advisories/ocert-2008-015.htmlhttp://www.securityfocus.com/archive/1/501712/100/0/threadedhttp://www.securityfocus.com/bid/34100http://www.ubuntu.com/usn/USN-735-1https://exchange.xforce.ibmcloud.com/vulnerabilities/49274https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9694http://cgit.freedesktop.org/gstreamer/gst-plugins-base/commit/?id=566583e87147f774e7fc4c78b5f7e61d427e40a9http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.htmlhttp://ocert.org/patches/2008-015/gst-plugins-base-CVE-2009-0586.diffhttp://openwall.com/lists/oss-security/2009/03/12/2http://secunia.com/advisories/34335http://secunia.com/advisories/34350http://secunia.com/advisories/35777http://security.gentoo.org/glsa/glsa-200907-11.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:085http://www.ocert.org/advisories/ocert-2008-015.htmlhttp://www.securityfocus.com/archive/1/501712/100/0/threadedhttp://www.securityfocus.com/bid/34100http://www.ubuntu.com/usn/USN-735-1https://exchange.xforce.ibmcloud.com/vulnerabilities/49274https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9694
2009-03-14
Published