CVE-2023-38103 GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability

🗓️ 03 May 2024 01:59:04Reported by zdiType

GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This allows remote attackers to execute arbitrary code on affected installations. Interaction with this library is required. The specific flaw exists within the parsing of MDPR chunks due to lack of proper validation of user-supplied data, resulting in integer overflow before allocating a buffer.

Reporter	Title	Published	Views	Family All 38
ATTACKERKB	CVE-2023-38103	3 May 202402:15	–	attackerkb
AlpineLinux	CVE-2023-38103	3 May 202401:59	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in gst-plugins-ugly1.0	3 May 202623:59	–	astralinux
BDU FSTEC	The vulnerability of the MDPR component in the Gstreamer multimedia framework allows a hacker to execute arbitrary code.	24 Aug 202300:00	–	bdu_fstec
CNNVD	GStreamer gstreamer-plugins-ugly Security Vulnerability	10 Aug 202300:00	–	cnnvd
CVE	CVE-2023-38103	3 May 202401:59	–	cve
Debian CVE	CVE-2023-38103	3 May 202401:59	–	debiancve
Tenable Nessus	Debian DSA-5476-1 : gst-plugins-ugly1.0 - security update	14 Aug 202300:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : gstreamer-plugins-ugly (SUSE-SU-2023:3222-1)	8 Aug 202300:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gstreamer-plugins-ugly (SUSE-SU-2023:3226-1)	9 Aug 202300:00	–	nessus

[
  {
    "vendor": "GStreamer",
    "product": "GStreamer",
    "versions": [
      {
        "version": "1.22.3",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-1007/
gitlab	www.gitlab.freedesktop.org/gstreamer/gstreamer/uploads/d4a0aa4ec2165f6c418703b9e1459d8b/0002-rmdemux-Check-for-integer-overflow-when-calculation-.patch

03 May 2024 01:59Current

8.8High risk

Vulners AI Score8.8

CVSS 38.8

EPSS0.07862

CWE-190