CVE-2021-3497

GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.

GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.(CVE-2021-3497)

GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.(CVE-2021-3498)

GStreamer is a streaming media framework based on graphs of filters that operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer-plugins-good: Use-after-free in matroska demuxing (CVE-2021-3497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.

GStreamer is a streaming media framework based on graphs of filters that operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer-plugins-good: Use-after-free in matroska demuxing (CVE-2021-3497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for gstreamer-plugins-good fixes the following issues:

• CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).
• CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for gstreamer-plugins-good fixes the following issues:

• CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).
• CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).

These are all security issues fixed in the gstreamer-plugins-good-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.

This update for gstreamer-plugins-good fixes the following issues:

• CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).
• CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).

This update for gstreamer-plugins-good fixes the following issues:

• CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).

This update for gstreamer-plugins-good fixes the following issues:

• CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).
• CVE-2022-1920: Fixed integer overflow in WavPack header handling code (bsc#1201688).
• CVE-2022-1921: Fixed integer overflow resulting in heap corruption in avidemux element (bsc#1201693).
• CVE-2022-1922: Fixed integer overflows in mkv demuxing (bsc#1201702).
• CVE-2022-1923: Fixed integer overflows in mkv demuxing using bzip (bsc#1201704).
• CVE-2022-1924: Fixed integer overflows in mkv demuxing using lzo (bsc#1201706).
• CVE-2022-1925: Fixed integer overflows in mkv demuxing using HEADERSTRIP (bsc#1201707).
• CVE-2022-2122: Fixed integer overflows in qtdemux using zlib (bsc#1201708).
• CVE-2023-37327: Fixed GStreamer FLAC File Parsing Integer Overflow (bsc#1213128).

It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to cause access sensitive information or cause a crash. (CVE-2021-3497)

It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3498)