GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22226.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0305-1 advisory.

    Adding references for already fixed vulnerability:

    - CVE-2023-50186: Fixed heap-based buffer overflow in the AV1 codec parser (ZDI-CAN-22300, bsc#1218534,     bsc#1223263)
    - CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).
    - CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free (bsc#1217213).
    - CVE-2023-44429: Fixed GStreamer AV1 Codec Parsing Heap-based Buffer Overflow (bsc#1217211).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the gstreamer package has been released.

The remote host is affected by the vulnerability described in GLSA-202406-06 (GStreamer, GStreamer Plugins: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE     identifiers referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7873 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429)

    * gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7791 advisory.

    - Patch CVE-2023-44429: AV1 codec parser heap-based buffer overflow
    - Patch CVE-2023-44446: MXF demuxer use-after-free

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4874-1 advisory.

  - Fixes for GStreamer-SA-2023-0010 (ZDI-CAN-22299)  and GStreamer-SA-2023-0009 (ZDI-CAN-22226)     (CVE-2023-44429)    (CVE-2023-44429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4875-1 advisory.

  - Fixes for GStreamer-SA-2023-0010 (ZDI-CAN-22299)  and GStreamer-SA-2023-0009 (ZDI-CAN-22226)     (CVE-2023-44429)    (CVE-2023-44429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7791 advisory.

  - Fixes for GStreamer-SA-2023-0010 (ZDI-CAN-22299)  and GStreamer-SA-2023-0009 (ZDI-CAN-22226)     (CVE-2023-44429)    (CVE-2023-44429)

  - MXF demuxer use-after-free vulnerability [fedora-all] (CVE-2023-44446)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7791 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429)

    * gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7792 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429)

    * gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2355 advisory.

    gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429)

    gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-7bd66f219f advisory.

    Fixes for GStreamer-SA-2023-0010 (ZDI-CAN-22299)  and GStreamer-SA-2023-0009 (ZDI-CAN-22226)     (CVE-2023-44429)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6526-1 advisory.

    It was discovered that GStreamer Bad Plugins incorrectly handled certain media files. A remote attacker     could use this issue to cause GStreamer Bad Plugins to crash, resulting in a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5565 advisory.

  - AV1 codec parser buffer overflow [fedora-all] (CVE-2023-44429)

  - MXF demuxer use-after-free vulnerability [fedora-all] (CVE-2023-44446)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-1661e0af22 advisory.

    Fixes for GStreamer-SA-2023-0010 (ZDI-CAN-22299)  and GStreamer-SA-2023-0009 (ZDI-CAN-22226)     (CVE-2023-44429)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-6a4aea6d13 advisory.

    1.22.7



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207371	openSUSE 15 Security Update : gstreamer-plugins-bad (openSUSE-SU-2024:0305-1)	Nessus	SuSE Local Security Checks	high
204354	Photon OS 5.0: Gstreamer PHSA-2023-5.0-0167	Nessus	PhotonOS Local Security Checks	high
204259	Photon OS 4.0: Gstreamer PHSA-2023-4.0-0523	Nessus	PhotonOS Local Security Checks	high
201161	GLSA-202406-06 : GStreamer, GStreamer Plugins: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
187085	RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2023:7873)	Nessus	Red Hat Local Security Checks	high
187026	Oracle Linux 9 : gstreamer1-plugins-bad-free (ELSA-2023-7791)	Nessus	Oracle Linux Local Security Checks	high
187018	SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-bad (SUSE-SU-2023:4874-1)	Nessus	SuSE Local Security Checks	high
187004	SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-bad (SUSE-SU-2023:4875-1)	Nessus	SuSE Local Security Checks	high
186943	AlmaLinux 9 : gstreamer1-plugins-bad-free (ALSA-2023:7791)	Nessus	Alma Linux Local Security Checks	high
186846	RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2023:7791)	Nessus	Red Hat Local Security Checks	high
186842	RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2023:7792)	Nessus	Red Hat Local Security Checks	high
186557	Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2023-2355)	Nessus	Amazon Linux Local Security Checks	high
186455	Fedora 38 : gst-devtools / gstreamer1 / gstreamer1-doc / python-gstreamer1 (2023-7bd66f219f)	Nessus	Fedora Local Security Checks	high
186441	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : GStreamer Bad Plugins vulnerabilities (USN-6526-1)	Nessus	Ubuntu Local Security Checks	high
186283	Debian DSA-5565-1 : gst-plugins-bad1.0 - security update	Nessus	Debian Local Security Checks	high
185984	Fedora 39 : gst-devtools / gstreamer1 / gstreamer1-doc / python-gstreamer1 (2023-1661e0af22)	Nessus	Fedora Local Security Checks	high
185982	Fedora 39 : gstreamer1-plugin-libav / gstreamer1-plugins-bad-free / etc (2023-6a4aea6d13)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-44429

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high