CVE-2021-3522 — Out-of-bounds Read in Gstreamer

CWE-125 — Out-of-bounds Read8 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 67.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GstreamerNetapp E-series Santricity OS ControllerOracle Openjdk
Timeline
PublishedJun 2
Latest updateMay 24

Description

GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDgstreamer/gstreamer< 1.18.4
▶CVEListV5gstreamer/gstreamerAll GStreamer version before 1.18.4

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-x3cx-v22q-v4cr: GStreamer before 1↗2022-05-24
▶
CVEList
CVE-2021-3522: GStreamer before 1↗2021-06-02
▶
OSV
CVE-2021-3522: GStreamer before 1↗2021-06-02
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Java SE Risk Matrix: JavaFX (GStreamer) — CVE-2021-3522↗2021-10-15
▶
Ubuntu
GStreamer Base Plugins vulnerability↗2021-05-18
▶
Red Hat
gstreamer-plugins-base: out-of-bounds read when handling certain ID3v2 tags↗2021-03-15
▶
Debian
CVE-2021-3522: gst-plugins-base1.0 - GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ...↗2021
▶
CVE-2021-3522 — Out-of-bounds Read in Gstreamer | cvebase