Commit c90f71af authored by Tim-Philipp Müller's avatar Tim-Philipp Müller 🐠
Browse files

security: add new 2022 security advisories for mkv/mp4 demuxing

For CVE-2022-1920, CVE-2022-1921, CVE-2022-1922, CVE-2022-1923,
CVE-2022-1924, CVE-2022-1925, and CVE-2022-tbd.
parent 17ccaede
......@@ -9,6 +9,10 @@ ALERTS = \
sa-2021-0003.xml \
sa-2021-0004.xml \
sa-2021-0005.xml \
sa-2022-0001.xml \
sa-2022-0002.xml \
sa-2022-0003.xml \
sa-2022-0004.xml \
$(NULL)
security_pages = $(patsubst %.xml,%.html,$(ALERTS))
......
......@@ -6,6 +6,10 @@
]>
<wrapper xmlns:xi="http://www.w3.org/2001/XInclude">
<alerts>
<xi:include href="sa-2022-0004.xml" parse="xml" />
<xi:include href="sa-2022-0003.xml" parse="xml" />
<xi:include href="sa-2022-0002.xml" parse="xml" />
<xi:include href="sa-2022-0001.xml" parse="xml" />
<xi:include href="sa-2021-0005.xml" parse="xml" />
<xi:include href="sa-2021-0004.xml" parse="xml" />
<xi:include href="sa-2021-0003.xml" parse="xml" />
......
<?xml-stylesheet href="advisory-detail.xsl" type="text/xsl"?>
<!DOCTYPE xsl:stylesheet
[
<!ENTITY % site-entities SYSTEM "../entities.site">
%site-entities;
]>
<advisory>
<id>2022-0001</id>
<alternate-name>CVE-2022-1921</alternate-name>
<date>2022-06-15 23:00</date>
<summary>Heap overwrite in avi demuxing</summary>
<affected-versions>GStreamer gst-plugins-good 1.x &lt; 1.20.3, 0.10.x</affected-versions>
<details>Heap-based buffer overflow in the avi demuxer when handling certain AVI files in GStreamer versions before 1.20.3.</details>
<impact>It is possible for a malicious third party to trigger a crash in the application, and possibly also effect code execution through heap manipulation.</impact>
<mitigation></mitigation>
<workarounds></workarounds>
<solution></solution>
<solution>The gst-plugins-good 1.20.3 release addresses the issue. People using older branches of GStreamer should apply the patch and recompile.</solution>
<references>
<reference>
<title>The GStreamer project</title>
<content> <a href="https://gstreamer.freedesktop.org">https://gstreamer.freedesktop.org</a></content>
</reference>
<reference>
<title> CVE Database Entries </title>
<content> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1921">CVE-2022-1921</a> </content>
</reference>
<reference>
<title>GStreamer 1.20.3 release</title>
<content>
<a href="https://gstreamer.freedesktop.org/releases/1.20/#1.20.3">Release Notes</a>
<a href="https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-1.20.3.tar.xz">GStreamer Plugins Good 1.20.3</a>
</content>
</reference>
<reference>
<title>Patches</title>
<content>
<a href="https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f503caad676971933dc0b52c4b313e5ef0d6dbb0.patch">Patch 1</a></content>
</reference>
</references>
</advisory>
<?xml-stylesheet href="advisory-detail.xsl" type="text/xsl"?>
<!DOCTYPE xsl:stylesheet
[
<!ENTITY % site-entities SYSTEM "../entities.site">
%site-entities;
]>
<advisory>
<id>2022-0002</id>
<alternate-name>CVE-2022-1922</alternate-name>
<alternate-name>CVE-2022-1923</alternate-name>
<alternate-name>CVE-2022-1924</alternate-name>
<alternate-name>CVE-2022-1925</alternate-name>
<date>2022-06-15 23:00</date>
<summary>Potential heap overwrite in mkv demuxing using zlib/bz2/lzo decompression</summary>
<affected-versions>GStreamer gst-plugins-good 1.x &lt; 1.20.3, 0.10.x</affected-versions>
<details>Potential heap overwrite in the mkv demuxer when handling certain Matroska/WebM files in GStreamer versions before 1.20.3.</details>
<impact>It is possible for a malicious third party to trigger a crash in the application, and possibly also overwrite data on the heap.</impact>
<mitigation></mitigation>
<workarounds></workarounds>
<solution></solution>
<solution>The gst-plugins-good 1.20.3 release addresses the issue. People using older branches of GStreamer should apply the patch and recompile.</solution>
<references>
<reference>
<title>The GStreamer project</title>
<content> <a href="https://gstreamer.freedesktop.org">https://gstreamer.freedesktop.org</a></content>
</reference>
<reference>
<title> CVE Database Entries </title>
<content> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1922">CVE-2022-1922</a> </content>
<content> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1923">CVE-2022-1923</a> </content>
<content> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1924">CVE-2022-1924</a> </content>
<content> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1925">CVE-2022-1925</a> </content>
</reference>
<reference>
<title>GStreamer 1.20.3 release</title>
<content>
<a href="https://gstreamer.freedesktop.org/releases/1.20/#1.20.3">Release Notes</a>
<a href="https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-1.20.3.tar.xz">GStreamer Plugins Good 1.20.3</a>
</content>
</reference>
<reference>
<title>Patches</title>
<content>
<a href="https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ad6012159acf18c6b5c0f4edf037e8c9a2dbc966.patch">Patch 1</a></content>
</reference>
</references>
</advisory>
<?xml-stylesheet href="advisory-detail.xsl" type="text/xsl"?>
<!DOCTYPE xsl:stylesheet
[
<!ENTITY % site-entities SYSTEM "../entities.site">
%site-entities;
]>
<advisory>
<id>2022-0003</id>
<alternate-name>CVE-2022-XXXX (CVE requested)</alternate-name> <!-- FIXME: still waiting for a CVE to be assigned -->
<date>2022-06-15 23:00</date>
<summary>Potential heap overwrite in mp4 demuxing using zlib decompression</summary>
<affected-versions>GStreamer gst-plugins-good 1.x &lt; 1.20.3, 0.10.x</affected-versions>
<details>Potential heap overwrite in the qt demuxer when handling certain QuickTime/MP4 files in GStreamer versions before 1.20.3.</details>
<impact>It is possible for a malicious third party to trigger a crash in the application, and possibly also overwrite data on the heap.</impact>
<mitigation></mitigation>
<workarounds></workarounds>
<solution></solution>
<solution>The gst-plugins-good 1.20.3 release addresses the issue. People using older branches of GStreamer should apply the patch and recompile.</solution>
<references>
<reference>
<title>The GStreamer project</title>
<content> <a href="https://gstreamer.freedesktop.org">https://gstreamer.freedesktop.org</a></content>
</reference>
<!-- FIXME
<reference>
<title> CVE Database Entries </title>
<content> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-XXXX">CVE-2022-XXXX</a> </content>
</reference>
-->
<reference>
<title>GStreamer 1.20.3 release</title>
<content>
<a href="https://gstreamer.freedesktop.org/releases/1.20/#1.20.3">Release Notes</a>
<a href="https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-1.20.3.tar.xz">GStreamer Plugins Good 1.20.3</a>
</content>
</reference>
<reference>
<title>Patches</title>
<content>
<a href="https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/14d306da6da51a762c4dc701d161bb52ab66d774.patch">Patch 1</a></content>
</reference>
</references>
</advisory>
<?xml-stylesheet href="advisory-detail.xsl" type="text/xsl"?>
<!DOCTYPE xsl:stylesheet
[
<!ENTITY % site-entities SYSTEM "../entities.site">
%site-entities;
]>
<advisory>
<id>2022-0004</id>
<alternate-name>CVE-2022-1920</alternate-name>
<date>2022-06-15 23:00</date>
<summary>Potential heap overwrite in gst_matroska_demux_add_wvpk_header</summary>
<affected-versions>GStreamer gst-plugins-good 1.x &lt; 1.20.3, 0.10.x</affected-versions>
<details>Potential heap overwrite in the mkv demuxer when handling certain Matroska files in GStreamer versions before 1.20.3.</details>
<impact>It is possible for a malicious third party to overwrite data on the heap, and possibly even effect code execution.</impact>
<mitigation></mitigation>
<workarounds></workarounds>
<solution></solution>
<solution>The gst-plugins-good 1.20.3 release addresses the issue. People using older branches of GStreamer should apply the patch and recompile.</solution>
<references>
<reference>
<title>The GStreamer project</title>
<content> <a href="https://gstreamer.freedesktop.org">https://gstreamer.freedesktop.org</a></content>
</reference>
<reference>
<title> CVE Database Entries </title>
<content> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1922">CVE-2022-1920</a> </content>
</reference>
<reference>
<title>GStreamer 1.20.3 release</title>
<content>
<a href="https://gstreamer.freedesktop.org/releases/1.20/#1.20.3">Release Notes</a>
<a href="https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-1.20.3.tar.xz">GStreamer Plugins Good 1.20.3</a>
</content>
</reference>
<reference>
<title>Patches</title>
<content>
<a href="https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/cf887f1b8e228bff6e19829e6d03995d70ad739d.patch">Patch 1</a></content>
</reference>
</references>
</advisory>
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment