CVE-2021-3497
published 2021-04-19CVE-2021-3497: GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
PriorityP337high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.22%
65.2th percentile
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | gst-plugins-good1.0 | < gst-plugins-good1.0 1.18.4-2 (bookworm) | gst-plugins-good1.0 1.18.4-2 (bookworm) |
| gstreamer | gstreamer | >= 0.10.0 < 1.18.4 | 1.18.4 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GStreamer Good Plugins vulnerabilities
vendor_ubuntu·2021-04-28·CVSS 7.8
CVE-2021-3498 [HIGH] GStreamer Good Plugins vulnerabilities
Title: GStreamer Good Plugins vulnerabilities
Summary: Several security issues were fixed in GStreamer Plugins Good.
It was discovered that GStreamer Good Plugins incorrectly handled certain files.
An attacker could possibly use this issue to cause access sensitive information
or cause a crash. (CVE-2021-3497)
It was discovered that GStreamer Good Plugins incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code or cause
a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
20.10. (CVE-2021-3498)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
gstreamer-plugins-good: Use-after-free in matroska demuxing
vendor_redhat·2021-03-15·CVSS 7.8
CVE-2021-3497 [HIGH] CWE-416 gstreamer-plugins-good: Use-after-free in matroska demuxing
gstreamer-plugins-good: Use-after-free in matroska demuxing
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
Package: gstreamer-plugins-good (Red Hat Enterprise Linux 6) - Out of support scope
Package: gstreamer1-plugins-good (Red Hat Enterprise Linux 7) - Will not fix
Package: gstreamer-plugins-good (Red Hat Enterprise Linux 7) - Will not fix
Package: gstreamer1-plugins-good (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2021-3497: gst-plugins-good1.0 - GStreamer before 1.18.4 might access already-freed memory in error code paths wh...
vendor_debian·2021·CVSS 7.8
CVE-2021-3497 [HIGH] CVE-2021-3497: gst-plugins-good1.0 - GStreamer before 1.18.4 might access already-freed memory in error code paths wh...
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
Scope: local
bookworm: resolved (fixed in 1.18.4-2)
bullseye: resolved (fixed in 1.18.4-2)
forky: resolved (fixed in 1.18.4-2)
sid: resolved (fixed in 1.18.4-2)
trixie: resolved (fixed in 1.18.4-2)
GHSA
GHSA-9gpj-v2gq-r9fx: GStreamer before 1
ghsa_unreviewed·2022-05-24
CVE-2021-3497 [HIGH] CWE-416 GHSA-9gpj-v2gq-r9fx: GStreamer before 1
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
OSV
gst-plugins-good1.0 vulnerabilities
osv·2021-04-28·CVSS 7.8
CVE-2021-3497 [HIGH] gst-plugins-good1.0 vulnerabilities
gst-plugins-good1.0 vulnerabilities
It was discovered that GStreamer Good Plugins incorrectly handled certain files.
An attacker could possibly use this issue to cause access sensitive information
or cause a crash. (CVE-2021-3497)
It was discovered that GStreamer Good Plugins incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code or cause
a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
20.10. (CVE-2021-3498)
OSV
CVE-2021-3497: GStreamer before 1
osv·2021-04-19·CVSS 7.8
CVE-2021-3497 [HIGH] CVE-2021-3497: GStreamer before 1
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1945339https://gstreamer.freedesktop.org/security/sa-2021-0002.htmlhttps://lists.debian.org/debian-lts-announce/2021/04/msg00027.htmlhttps://security.gentoo.org/glsa/202208-31https://www.debian.org/security/2021/dsa-4900https://bugzilla.redhat.com/show_bug.cgi?id=1945339https://gstreamer.freedesktop.org/security/sa-2021-0002.htmlhttps://lists.debian.org/debian-lts-announce/2021/04/msg00027.htmlhttps://security.gentoo.org/glsa/202208-31https://www.debian.org/security/2021/dsa-4900
2021-04-19
Published