Summary
It was discovered that GStreamer Base Plugins did not correctly handle
certain malformed RTSP streams. If a user were tricked into opening a
crafted RTSP stream with a GStreamer application, an attacker could cause a
denial of service via application crash, or possibly execute arbitrary
code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | gst-plugins-base0.10 | 0.10.36-2ubuntu0.2 |
| Ubuntu · 16.04 LTS 16.04:LTS | gst-plugins-base1.0 | 1.8.3-1ubuntu0.3 |
| Ubuntu · 18.04 LTS 18.04:LTS | gst-plugins-base1.0 | 1.14.1-1ubuntu1~ubuntu18.04.2 |
Vulnerabilities 1
-
Unscored —
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a se…
References
-
report
https://ubuntu.com/security/CVE-2019-9928