{"id":"CVE-2021-3497","aliases":["ALPINE-CVE-2021-3497","ALSA-2022:7618","BELL-CVE-2021-3497","DEBIAN-CVE-2021-3497","DLA-2640-1","DSA-4900-1","EUVD-2021-26818","GHSA-9gpj-v2gq-r9fx","OESA-2021-1322","RHSA-2022:7618","RLSA-2022:7618","SUSE-SU-2021:2915-1","SUSE-SU-2021:2916-1","SUSE-SU-2023:3688-1","UBUNTU-CVE-2021-3497","USN-4928-1","openSUSE-SU-2021:1230-1","openSUSE-SU-2021:2915-1","openSUSE-SU-2024:11778-1"],"status":"published","title":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing...","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01219,"percentile":0.68859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2021-04-19T20:22:15Z","modified":"2026-11-03T06:32:40Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gst-plugins-good","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gstreamer","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good","fixed_in":["1.16.1-3.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good-gtk","fixed_in":["1.16.1-3.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-good1.0","fixed_in":["1.18.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-good1.0","fixed_in":["1.18.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-good1.0","fixed_in":["1.18.4-2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"gst-plugins-good1.0","fixed_in":["1.10.4-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.16.1-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.16.1-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.16.1-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.16.1-3.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-3.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gstreamer-plugins-good","fixed_in":["1.8.3-16.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gstreamer-plugins-good","fixed_in":["1.8.3-16.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.8.3-1ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.14.5-0ubuntu1~18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.16.2-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gst-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-3.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-3.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-1+deb9u1"}]}],"versions":["1.10.4-1"]},{"source":"osv","ecosystem":"Debian:10","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-1+deb10u1"}]}],"versions":["1.14.4-1"],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-3.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-150000.3.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-150000.3.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.5"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.2-1ubuntu0.3","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.2"}]}],"versions":["1.12.3-1ubuntu1","1.12.4-1ubuntu1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-1ubuntu2.1"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.5"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.2-1ubuntu0.3","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.2"}]}],"versions":["1.12.3-1ubuntu1","1.12.4-1ubuntu1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-1ubuntu2.1"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-lp152.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.6.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gstreamer","product":"gstreamer"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945339","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2021-0002.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://www.debian.org/security/2021/dsa-4900","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00027.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-31","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3497","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9gpj-v2gq-r9fx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3497","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7618","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3497","tags":["report"]},{"url":"https://bugzilla.redhat.com/1945339","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-7618.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-3497","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3497","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3498","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7618.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3497","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:7618","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212915-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184735","tags":["report"]},{"url":"https://bugzilla.suse.com/1184739","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3498","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212916-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233688-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201688","tags":["report"]},{"url":"https://bugzilla.suse.com/1201693","tags":["report"]},{"url":"https://bugzilla.suse.com/1201702","tags":["report"]},{"url":"https://bugzilla.suse.com/1201704","tags":["report"]},{"url":"https://bugzilla.suse.com/1201706","tags":["report"]},{"url":"https://bugzilla.suse.com/1201707","tags":["report"]},{"url":"https://bugzilla.suse.com/1201708","tags":["report"]},{"url":"https://bugzilla.suse.com/1213128","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-37327","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-3497","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/commit/9181191511f9c0be6a89c98b311f49d66bd46dc3?merge_request_iid=903","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4928-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3498","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GU3E72N7AIZNV6RLT3OM7V74BRCXVX4R/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/D4IXFQFYFPMAJPYIAVGSDNJC7W6WWQID/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3497","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","status":"published","published":"2021-04-19T20:22:15Z","modified":"2024-08-03T16:53:17.981Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-26818","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","status":"published","published":"2021-04-19T20:22:15Z","modified":"2024-08-03T16:53:17Z","updated_at":"2026-11-03T03:25:13.052236Z"}],"ghsa":[{"id":"GHSA-9gpj-v2gq-r9fx","title":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing...","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","status":"published","published":"2022-05-24T17:47:53Z","modified":"2023-01-27T05:02:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:42:05.930236Z"}],"nvd":[{"id":"CVE-2021-3497","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","status":"published","published":"2021-04-19T21:15:13.113Z","modified":"2026-06-17T04:05:12.637Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:52.03307Z"}],"osv":[{"id":"ALPINE-CVE-2021-3497","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","status":"published","published":"2021-04-19T21:15:13.113Z","modified":"2026-11-03T06:32:40.619952309Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"BELL-CVE-2021-3497","title":"CVE-2021-3497 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:01.183638Z","modified":"2026-01-26T09:48:02.752451Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-3497","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","status":"published","published":"2021-04-19T21:15:13.113Z","modified":"2026-10-24T10:31:04.999961821Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3497","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","status":"published","published":"2021-04-19T21:15:13.113Z","modified":"2026-10-23T18:04:00.165465339Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1322","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nGStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.(CVE-2021-3497)\r\n\r\nGStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.(CVE-2021-3498)","status":"published","published":"2021-08-20T11:04:33Z","modified":"2026-08-18T01:15:56.747551696Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2022:7618","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2024-09-16T08:36:03Z","modified":"2026-08-01T10:30:22.316687256Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:7618","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters that operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer-plugins-good: Use-after-free in matroska demuxing (CVE-2021-3497)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.","status":"published","published":"2022-11-08T06:24:50Z","modified":"2026-02-04T20:15:13.240268Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-3497","description":"GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.","status":"published","published":"2021-04-19T21:15:00Z","modified":"2026-04-22T12:55:18.482733Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"ALSA-2022:7618","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters that operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer-plugins-good: Use-after-free in matroska demuxing (CVE-2021-3497)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-08T00:00:00Z","modified":"2026-10-29T11:01:08.632933007Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"DLA-2640-1","title":"gst-plugins-good1.0 - security update","status":"published","published":"2021-04-26T00:00:00Z","modified":"2026-03-09T01:21:53.713867Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4900-1","title":"gst-plugins-good1.0 - security update","status":"published","published":"2021-04-24T00:00:00Z","modified":"2026-03-09T02:09:09.256436Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2021:1230-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).\n- CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-09-05T14:05:42Z","modified":"2026-02-04T02:29:20.922697Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2915-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).\n- CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).\n","status":"published","published":"2021-09-02T07:57:07Z","modified":"2026-02-04T02:58:26.877979Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11778-1","title":"gstreamer-plugins-good-1.18.5-3.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-good-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:16:09.380277Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:2915-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).\n- CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).\n","status":"published","published":"2021-09-02T07:57:02Z","modified":"2026-02-04T03:45:08.444144Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2916-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).\n","status":"published","published":"2021-09-02T07:58:22Z","modified":"2026-02-04T02:45:01.992925Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2023:3688-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).\n- CVE-2022-1920: Fixed integer overflow in WavPack header handling code (bsc#1201688).\n- CVE-2022-1921: Fixed integer overflow resulting in heap corruption in avidemux element (bsc#1201693).\n- CVE-2022-1922: Fixed integer overflows in mkv demuxing (bsc#1201702).\n- CVE-2022-1923: Fixed integer overflows in mkv demuxing using bzip (bsc#1201704).\n- CVE-2022-1924: Fixed integer overflows in mkv demuxing using lzo (bsc#1201706).\n- CVE-2022-1925: Fixed integer overflows in mkv demuxing using HEADERSTRIP (bsc#1201707).\n- CVE-2022-2122: Fixed integer overflows in qtdemux using zlib (bsc#1201708).\n- CVE-2023-37327: Fixed GStreamer FLAC File Parsing Integer Overflow (bsc#1213128).\n","status":"published","published":"2023-09-19T15:40:17Z","modified":"2026-02-04T03:57:30.895361Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-4928-1","title":"gst-plugins-good1.0 vulnerabilities","description":"It was discovered that GStreamer Good Plugins incorrectly handled certain files.\nAn attacker could possibly use this issue to cause access sensitive information\nor cause a crash. (CVE-2021-3497)\n\nIt was discovered that GStreamer Good Plugins incorrectly handled certain files.\nAn attacker could possibly use this issue to execute arbitrary code or cause\na crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu\n20.10. (CVE-2021-3498)\n","status":"published","published":"2021-04-28T17:15:06Z","modified":"2026-04-22T10:14:07.181457Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}