DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gstmatroskadecompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
{ "ubuntu_priority": "medium", "binaries": [ { "binary_name": "gstreamer1.0-plugins-good", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "gstreamer1.0-plugins-good-dbg", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "gstreamer1.0-plugins-good-dbgsym", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "gstreamer1.0-plugins-good-doc", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "gstreamer1.0-pulseaudio", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "gstreamer1.0-pulseaudio-dbgsym", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "libgstreamer-plugins-good1.0-0", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "libgstreamer-plugins-good1.0-0-dbgsym", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "libgstreamer-plugins-good1.0-dev", "binary_version": "1.8.3-1ubuntu0.5+esm1" }, { "binary_name": "libgstreamer-plugins-good1.0-dev-dbgsym", "binary_version": "1.8.3-1ubuntu0.5+esm1" } ], "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro" }
{ "ubuntu_priority": "medium", "binaries": [ { "binary_name": "gstreamer1.0-gtk3", "binary_version": "1.14.5-0ubuntu1~18.04.3" }, { "binary_name": "gstreamer1.0-plugins-good", "binary_version": "1.14.5-0ubuntu1~18.04.3" }, { "binary_name": "gstreamer1.0-plugins-good-dbg", "binary_version": "1.14.5-0ubuntu1~18.04.3" }, { "binary_name": "gstreamer1.0-plugins-good-doc", "binary_version": "1.14.5-0ubuntu1~18.04.3" }, { "binary_name": "gstreamer1.0-pulseaudio", "binary_version": "1.14.5-0ubuntu1~18.04.3" }, { "binary_name": "gstreamer1.0-qt5", "binary_version": "1.14.5-0ubuntu1~18.04.3" }, { "binary_name": "libgstreamer-plugins-good1.0-0", "binary_version": "1.14.5-0ubuntu1~18.04.3" }, { "binary_name": "libgstreamer-plugins-good1.0-dev", "binary_version": "1.14.5-0ubuntu1~18.04.3" } ], "availability": "No subscription required" }
{ "ubuntu_priority": "medium", "binaries": [ { "binary_name": "gstreamer1.0-gtk3", "binary_version": "1.16.3-0ubuntu1.1" }, { "binary_name": "gstreamer1.0-plugins-good", "binary_version": "1.16.3-0ubuntu1.1" }, { "binary_name": "gstreamer1.0-plugins-good-dbg", "binary_version": "1.16.3-0ubuntu1.1" }, { "binary_name": "gstreamer1.0-plugins-good-doc", "binary_version": "1.16.3-0ubuntu1.1" }, { "binary_name": "gstreamer1.0-pulseaudio", "binary_version": "1.16.3-0ubuntu1.1" }, { "binary_name": "gstreamer1.0-qt5", "binary_version": "1.16.3-0ubuntu1.1" }, { "binary_name": "libgstreamer-plugins-good1.0-0", "binary_version": "1.16.3-0ubuntu1.1" }, { "binary_name": "libgstreamer-plugins-good1.0-dev", "binary_version": "1.16.3-0ubuntu1.1" } ], "availability": "No subscription required" }
{ "ubuntu_priority": "medium", "binaries": [ { "binary_name": "gstreamer1.0-gtk3", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "gstreamer1.0-gtk3-dbgsym", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "gstreamer1.0-plugins-good", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "gstreamer1.0-plugins-good-dbgsym", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "gstreamer1.0-pulseaudio", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "gstreamer1.0-qt5", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "gstreamer1.0-qt5-dbgsym", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "libgstreamer-plugins-good1.0-0", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "libgstreamer-plugins-good1.0-0-dbgsym", "binary_version": "1.20.3-0ubuntu1" }, { "binary_name": "libgstreamer-plugins-good1.0-dev", "binary_version": "1.20.3-0ubuntu1" } ], "availability": "No subscription required" }