CVE-2023-40475 GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability

🗓️ 03 May 2024 02:11:11Reported by zdiType

GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability allows remote code execution on affected installations. Interaction with GStreamer library is required to exploit the vulnerability.

Reporter	Title	Published	Views	Family All 107
Tenable Nessus	Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2023-2298)	20 Oct 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0134: gstreamer1-plugins-bad-free (ALINUX3-SA-2024:0134)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : gstreamer1-plugins-bad-free (CESA-2024:3060)	22 May 202400:00	–	nessus
Tenable Nessus	Debian dla-3633 : gir1.2-gst-plugins-bad-1.0 - security update	29 Oct 202300:00	–	nessus
Tenable Nessus	Debian DSA-5533-1 : gst-plugins-bad1.0 - security update	25 Oct 202300:00	–	nessus
Tenable Nessus	GLSA-202406-06 : GStreamer, GStreamer Plugins: Multiple Vulnerabilities	29 Jun 202400:00	–	nessus
Tenable Nessus	MiracleLinux 9 : gstreamer1-plugins-bad-free-1.22.1-4.el9 (AXSA:2024-8037:03)	20 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 8 : gstreamer1-plugins-bad-free-1.16.1-4.el8 (AXSA:2024-8316:04)	20 Jan 202600:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : gstreamer-plugins-bad (openSUSE-SU-2024:0305-1)	18 Sep 202400:00	–	nessus
Tenable Nessus	Oracle Linux 9 : gstreamer1-plugins-bad-free (ELSA-2024-2287)	6 May 202400:00	–	nessus

[
  {
    "vendor": "GStreamer",
    "product": "GStreamer",
    "versions": [
      {
        "version": "1.22.4 and 8dddb9ad2009705dfc3e50d59d7c56fc7314cfc3",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-1457/
gstreamer	www.gstreamer.freedesktop.org/security/sa-2023-0007.html

18 Sep 2024 18:29Current

8.8High risk

Vulners AI Score8.8

CVSS 38.8

EPSS0.0428

CWE-190