CVE-2009-0397

2009-02-0311:30:00

CWE-119

[email protected]

web.nvd.nist.gov

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.6

Confidence

Low

EPSS

0.086

Percentile

94.5%

JSON

Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka gstreamer-plugins) 0.8.5, might allow remote attackers to execute arbitrary code via crafted Time-to-sample (aka stts) atom data in a malformed QuickTime media .mov file.

Affected configurations

Nvd

Node

gstreamergood_plug-insMatch0.10.9

gstreamergood_plug-insMatch0.10.10

gstreamergood_plug-insMatch0.10.11

gstreamerplug-insMatch0.8.5

VendorProductVersionCPE
gstreamergood_plug-ins0.10.9cpe:2.3:a:gstreamer:good_plug-ins:0.10.9:*:*:*:*:*:*:*
gstreamergood_plug-ins0.10.10cpe:2.3:a:gstreamer:good_plug-ins:0.10.10:*:*:*:*:*:*:*
gstreamergood_plug-ins0.10.11cpe:2.3:a:gstreamer:good_plug-ins:0.10.11:*:*:*:*:*:*:*
gstreamerplug-ins0.8.5cpe:2.3:a:gstreamer:plug-ins:0.8.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gstreamer	good_plug-ins	0.10.9	cpe:2.3:a:gstreamer:good_plug-ins:0.10.9:::::::*
gstreamer	good_plug-ins	0.10.10	cpe:2.3:a:gstreamer:good_plug-ins:0.10.10:::::::*
gstreamer	good_plug-ins	0.10.11	cpe:2.3:a:gstreamer:good_plug-ins:0.10.11:::::::*
gstreamer	plug-ins	0.8.5	cpe:2.3:a:gstreamer:plug-ins:0.8.5:::::::*