CVE-2023-37329

2024-05-0302:15:43

Alpine Linux Development Team

security.alpinelinux.org

gstreamer

srt file parsing

buffer overflow

remote code execution

vulnerability

attack vectors

srt subtitle files

validation

user-supplied data

zdi-can-20968

unix

8.5 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

15.6%

JSON

GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of SRT subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20968.

OSVersionArchitecturePackageVersionFilename
Alpineedge-communitynoarchgst-plugins-bad< 1.22.4-r0UNKNOWN
Alpine3.18-communitynoarchgst-plugins-bad< 1.22.4-r0UNKNOWN
Alpine3.19-communitynoarchgst-plugins-bad< 1.22.4-r0UNKNOWN
Alpine3.20-communitynoarchgst-plugins-bad< 1.22.4-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-community	noarch	gst-plugins-bad	< 1.22.4-r0	UNKNOWN
Alpine	3.18-community	noarch	gst-plugins-bad	< 1.22.4-r0	UNKNOWN
Alpine	3.19-community	noarch	gst-plugins-bad	< 1.22.4-r0	UNKNOWN
Alpine	3.20-community	noarch	gst-plugins-bad	< 1.22.4-r0	UNKNOWN