CVE-2021-3498
published 2021-04-19CVE-2021-3498: GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
PriorityP338high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.77%
75.6th percentile
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | gst-plugins-good1.0 | < gst-plugins-good1.0 1.18.4-2 (bookworm) | gst-plugins-good1.0 1.18.4-2 (bookworm) |
| gstreamer | gstreamer | >= 1.0.0 < 1.18.4 | 1.18.4 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hf4m-4x6v-4wvr: GStreamer before 1
ghsa_unreviewed·2022-05-24
CVE-2021-3498 [HIGH] CWE-119 GHSA-hf4m-4x6v-4wvr: GStreamer before 1
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
OSV
gst-plugins-good1.0 vulnerabilities
osv·2021-04-28·CVSS 7.8
CVE-2021-3497 [HIGH] gst-plugins-good1.0 vulnerabilities
gst-plugins-good1.0 vulnerabilities
It was discovered that GStreamer Good Plugins incorrectly handled certain files.
An attacker could possibly use this issue to cause access sensitive information
or cause a crash. (CVE-2021-3497)
It was discovered that GStreamer Good Plugins incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code or cause
a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
20.10. (CVE-2021-3498)
OSV
CVE-2021-3498: GStreamer before 1
osv·2021-04-19·CVSS 7.8
CVE-2021-3498 [HIGH] CVE-2021-3498: GStreamer before 1
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
Ubuntu
GStreamer Good Plugins vulnerabilities
vendor_ubuntu·2021-04-28·CVSS 7.8
CVE-2021-3498 [HIGH] GStreamer Good Plugins vulnerabilities
Title: GStreamer Good Plugins vulnerabilities
Summary: Several security issues were fixed in GStreamer Plugins Good.
It was discovered that GStreamer Good Plugins incorrectly handled certain files.
An attacker could possibly use this issue to cause access sensitive information
or cause a crash. (CVE-2021-3497)
It was discovered that GStreamer Good Plugins incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code or cause
a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
20.10. (CVE-2021-3498)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
gstreamer-plugins-good: Heap corruption in matroska demuxing
vendor_redhat·2021-03-15·CVSS 7.8
CVE-2021-3498 [HIGH] CWE-119 gstreamer-plugins-good: Heap corruption in matroska demuxing
gstreamer-plugins-good: Heap corruption in matroska demuxing
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
Package: gstreamer-plugins-good (Red Hat Enterprise Linux 6) - Out of support scope
Package: gstreamer1-plugins-good (Red Hat Enterprise Linux 7) - Will not fix
Package: gstreamer-plugins-good (Red Hat Enterprise Linux 7) - Will not fix
Package: gstreamer1-plugins-good (Red Hat Enterprise Linux 8) - Will not fix
Package: gstreamer1-plugins-good (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2021-3498: gst-plugins-good1.0 - GStreamer before 1.18.4 might cause heap corruption when parsing certain malform...
vendor_debian·2021·CVSS 7.8
CVE-2021-3498 [HIGH] CVE-2021-3498: gst-plugins-good1.0 - GStreamer before 1.18.4 might cause heap corruption when parsing certain malform...
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
Scope: local
bookworm: resolved (fixed in 1.18.4-2)
bullseye: resolved (fixed in 1.18.4-2)
forky: resolved (fixed in 1.18.4-2)
sid: resolved (fixed in 1.18.4-2)
trixie: resolved (fixed in 1.18.4-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/162952/Gstreamer-Matroska-Demuxing-Use-After-Free.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1945342https://gstreamer.freedesktop.org/security/sa-2021-0003.htmlhttps://security.gentoo.org/glsa/202208-31https://www.debian.org/security/2021/dsa-4900http://packetstormsecurity.com/files/162952/Gstreamer-Matroska-Demuxing-Use-After-Free.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1945342https://gstreamer.freedesktop.org/security/sa-2021-0003.htmlhttps://security.gentoo.org/glsa/202208-31https://www.debian.org/security/2021/dsa-4900
2021-04-19
Published