CVE-2023-40476 GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

🗓️ 03 May 2024 02:11:12Reported by zdiType

GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This allows remote attackers to execute arbitrary code on affected installations. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

Reporter	Title	Published	Views	Family All 106
Tenable Nessus	Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2023-2298)	20 Oct 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0134: gstreamer1-plugins-bad-free (ALINUX3-SA-2024:0134)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : gstreamer1-plugins-bad-free (CESA-2024:3060)	22 May 202400:00	–	nessus
Tenable Nessus	Debian dla-3633 : gir1.2-gst-plugins-bad-1.0 - security update	29 Oct 202300:00	–	nessus
Tenable Nessus	Debian DSA-5533-1 : gst-plugins-bad1.0 - security update	25 Oct 202300:00	–	nessus
Tenable Nessus	GLSA-202406-06 : GStreamer, GStreamer Plugins: Multiple Vulnerabilities	29 Jun 202400:00	–	nessus
Tenable Nessus	MiracleLinux 9 : gstreamer1-plugins-bad-free-1.22.1-4.el9 (AXSA:2024-8037:03)	20 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 8 : gstreamer1-plugins-bad-free-1.16.1-4.el8 (AXSA:2024-8316:04)	20 Jan 202600:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : gstreamer-plugins-bad (openSUSE-SU-2023:0409-1)	20 Dec 202300:00	–	nessus
Tenable Nessus	Oracle Linux 9 : gstreamer1-plugins-bad-free (ELSA-2024-2287)	6 May 202400:00	–	nessus

[
  {
    "vendor": "GStreamer",
    "product": "GStreamer",
    "versions": [
      {
        "version": "1.22.4 and 8dddb9ad2009705dfc3e50d59d7c56fc7314cfc3",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
gstreamer	www.gstreamer.freedesktop.org/security/sa-2023-0008.html
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-1458/

18 Sep 2024 18:29Current

8.7High risk

Vulners AI Score8.7

CVSS 38.8

EPSS0.02009

CWE-121