Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40476: Integer overflow in H.265 video parser leading to stack overwrite NOTE: https://gstreamer.freedesktop.org/security/sa-2023-0008.html NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5364 NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ff91a3d8d6f7e2412c44663bf30fad5c7fdbc9d9 CVE-2023-40475: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio NOTE: https://gstreamer.freedesktop.org/security/sa-2023-0007.html NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5362 NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/72742dee30cce7bf909639f82de119871566ce39 CVE-2023-40474: Integer overflow leading to heap overwrite in MXF file handling with uncompressed video NOTE: https://gstreamer.freedesktop.org/security/sa-2023-0006.html NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5362 NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ce17e968e4cf900d28ca5b46f6e095febc42b4f0
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | gstreamer1-plugins-bad-free | 0:1.18.4-5.amzn2.0.2 |
| Amazon Linux · 2 | gstreamer1-plugins-bad-free-debuginfo | 0:1.18.4-5.amzn2.0.2 |
| Amazon Linux · 2 | gstreamer1-plugins-bad-free-devel | 0:1.18.4-5.amzn2.0.2 |
Vulnerabilities 3
-
High 8.8
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerabili…
-
High 8.8
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerabili…
-
High 8.8
GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vuln…