Use After Free

2023-11-3018:06:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

use after free

gstreamer

mxf

vulnerability

code execution

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

JSON

gst-plugins-bad (MXF demuxer in GStreamer) is vulnerable to Use After Free. The vulnerability is caused when handling certain MXF video files which can allow an attacker to trigger a crash in the application and may allow code execution.

CPENameOperatorVersion
gst-plugins-bad:edgeeq1.20.3-r4
gst-plugins-bad:edgeeq1.18.4-r4
gst-plugins-bad:edgeeq1.22.0-r0
gst-plugins-bad:edgeeq1.20.3-r3
gst-plugins-bad:edgeeq1.18.6-r0
gst-plugins-bad:edgeeq1.20.4-r2
gst-plugins-bad:edgeeq1.20.3-r0
gst-plugins-bad:edgeeq1.16.2-r8
gst-plugins-bad:edgeeq1.20.5-r1
gst-plugins-bad:edgeeq1.22.3-r3

Name	Operator	Version
gst-plugins-bad:edge	eq	1.20.3-r4
gst-plugins-bad:edge	eq	1.18.4-r4
gst-plugins-bad:edge	eq	1.22.0-r0
gst-plugins-bad:edge	eq	1.20.3-r3
gst-plugins-bad:edge	eq	1.18.6-r0
gst-plugins-bad:edge	eq	1.20.4-r2
gst-plugins-bad:edge	eq	1.20.3-r0
gst-plugins-bad:edge	eq	1.16.2-r8
gst-plugins-bad:edge	eq	1.20.5-r1
gst-plugins-bad:edge	eq	1.22.3-r3