Description
Array index error in the gst_qtp_trak_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins (aka gstreamer-plugins) 0.6.0 allows remote attackers to have an unknown impact via a crafted QuickTime media file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | gstreamer-plugins +1 | 0.6.0-19 | RHSA-2009:0269 |
Advisories 1
- RHSA-2009:0269 Red Hat Security Advisory: gstreamer-plugins security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- RHSA-2009:0269 vendor-advisory
- 33830 third-party-advisory
- oval:org.mitre.oval:def:9886 vdb-entry signature
- [oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version) mailing-list