Description
Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | gst-plugins-good0.10 | 0.10.8-4.1~lenny2 | DSA-1839-1 |
| Debian 4.0 | gst-plugins-good0.10 | 0.10.4-4+etch1 | DSA-1839-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | gstreamer-plugins-good +1 | 0.10.9-1.el5_3.2 | RHSA-2009:1123 |
Advisories 2
- RHSA-2009:1123 Red Hat Security Advisory: gstreamer-plugins-good security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- DSA-1839-1 gst-plugins-good0.10 - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 35777 third-party-advisory
- 35583 third-party-advisory
- ADV-2009-1506 vdb-entry
- DSA-1839 vendor-advisory
- GLSA-200907-11 vendor-advisory
- http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=d9544bcc44adcef769cbdf7f6453e140058a3adc
- 35205 third-party-advisory
- 35172 vdb-entry
- oval:org.mitre.oval:def:10798 vdb-entry signature
- 35897 third-party-advisory
- 54827 vdb-entry
- RHSA-2009:1123 vendor-advisory
- MDVSA-2009:130 vendor-advisory