Moderate: gstreamer1-plugins-base security update
Summary
ALSA-2024:2302: Moderate: gstreamer1-plugins-base security update. Affects gstreamer1-plugins-base versions < 1.22.1-2.el9. Fixed in 1.22.1-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.
Vulnerability Detail
The gstreamer1-plugins-base package is affected by a heap overwrite vulnerability in subtitle parsing (CVE-2023-37328). This vulnerability could allow an attacker to overwrite heap memory, potentially leading to arbitrary code execution or a denial of service. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
1.22.1-2.el9
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the gstreamer1-plugins-base package is affected by a moderate heap overwrite vulnerability in subtitle parsing. It is recommended to update the package to version 1.22.1-2.el9 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for gstreamer1-plugins-base →
FAQ
GStreamer is a streaming media framework that allows the construction of graphs of media-handling components, such as filters, which operate on media data.
The vulnerability could allow an attacker to overwrite heap memory, potentially leading to arbitrary code execution or a denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
No, there are no known workarounds for this vulnerability. It is recommended to update the gstreamer1-plugins-base package to the latest version.
You can find more information about this vulnerability, including the CVE identifier, in the AlmaLinux Advisory ALSA-2024:2302 (https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2024:2302.json).
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-base.
