{"id":"CVE-2021-3522","aliases":["ALPINE-CVE-2021-3522","DEBIAN-CVE-2021-3522","DLA-2641-1","DSA-4903-1","EUVD-2021-26838","GHSA-x3cx-v22q-v4cr","MGASA-2021-0334","OESA-2021-1237","OESA-2022-1601","SUSE-SU-2022:3907-1","SUSE-SU-2022:3911-1","SUSE-SU-2022:3916-1","SUSE-SU-2023:3801-1","UBUNTU-CVE-2021-3522","USN-4959-1"],"status":"published","title":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05372,"percentile":0.9271,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2021-04-24T00:00:00Z","modified":"2026-10-24T10:30:15Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"gst-plugins-base","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gst-plugins-base","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gst-plugins-base","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gst-plugins-base","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gst-plugins-base","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gst-plugins-base","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gst-plugins-base","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-base1.0","fixed_in":["1.18.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-base1.0","fixed_in":["1.18.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-base1.0","fixed_in":["1.18.4-2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"gst-plugins-base1.0","fixed_in":["1.10.4-1+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"gst-plugins-base1.0","fixed_in":["1.14.4-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"gstreamer1.0-plugins-base","fixed_in":["1.16.0-2.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"gstreamer1.0-plugins-bad","fixed_in":["1.16.0-1.2.mga7","1.16.0-1.2.mga7.tainted"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"gstreamer1.0-plugins-base","fixed_in":["1.18.3-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"gstreamer1.0-plugins-bad","fixed_in":["1.18.3-1.1.mga8","1.18.3-1.1.mga8.tainted"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"gstreamer-plugins-base","fixed_in":["0.10.36-22.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"gstreamer1-plugins-base","fixed_in":["1.16.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"gstreamer1-plugins-base","fixed_in":["1.16.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"gstreamer1-plugins-base","fixed_in":["1.16.2-2.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.6.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.6.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.6.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"gstreamer-plugins-base","fixed_in":["1.16.3-150200.4.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"gstreamer-plugins-base","fixed_in":["1.8.3-13.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"gstreamer-0_10-plugins-base","fixed_in":["0.10.36-18.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.8.3-1ubuntu0.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.14.5-0ubuntu1~18.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","fixed_in":["1.16.2-4ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gst-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-1+deb9u2"}]}],"versions":["1.10.4-1","1.10.4-1+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-2+deb10u1"}]}],"versions":["1.14.4-2"]},{"source":"osv","ecosystem":"Mageia:7","package":"gstreamer1.0-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-2.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"gstreamer1.0-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1.2.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"gstreamer1.0-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1.2.mga7.tainted"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"gstreamer1.0-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"gstreamer1.0-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"gstreamer1.0-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.1.mga8.tainted"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-22.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"gstreamer1-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.6.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.6.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.6.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-150200.4.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"gstreamer-0_10-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.36-18.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-150000.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-150000.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-150000.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-150000.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3+esm1"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.1-1ubuntu1~ubuntu18.04.2","1.14.4-1ubuntu1.1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-4ubuntu0.1"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.2-2ubuntu3","1.16.2-2ubuntu4","1.16.2-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.3+esm1"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3"}]}],"versions":["1.12.3-1","1.12.4-1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.0-2ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.1-1ubuntu1~ubuntu18.04.2","1.14.4-1ubuntu1.1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gst-plugins-base1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-4ubuntu0.1"}]}],"versions":["1.16.1-1","1.16.2-1","1.16.2-2","1.16.2-2ubuntu3","1.16.2-2ubuntu4","1.16.2-4"]}],"products":[{"vendor":"gstreamer","product":"gstreamer"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"e-series_santricity_storage_manager"},{"vendor":"netapp","product":"e-series_santricity_web_services"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"santricity_unified_manager"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"netapp","product":"solidfire"},{"vendor":"oracle","product":"openjdk"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954761","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20211022-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-31","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3522","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211022-0004"},{"url":"https://github.com/advisories/GHSA-x3cx-v22q-v4cr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3522","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3522","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0334.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28977","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/2103","tags":["web"]},{"url":"https://www.debian.org/security/2021/dsa-4903","tags":["web"]},{"url":"https://www.debian.org/security/2021/dsa-4902","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4959-1","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1237","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1601","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223907-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185448","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3522","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223911-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223916-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233801-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213128","tags":["report"]},{"url":"https://bugzilla.suse.com/1213131","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-37327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-37328","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-3522","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/-/issues/876","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/-/commit/f4a1428a6997658625d529b9db60fde812fbf1ee","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/-/commit/8a88e5c1db05ebadfd4569955f6f47c23cdca3c4","tags":["report"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2021-0001.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3522","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-3522","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","status":"published","published":"2021-06-02T14:38:16Z","modified":"2026-05-28T19:34:19.891Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26838","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","status":"published","published":"2021-06-02T14:38:16Z","modified":"2026-05-28T19:34:19Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:21:01.680356Z"}],"ghsa":[{"id":"GHSA-x3cx-v22q-v4cr","title":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","status":"published","published":"2022-05-24T19:03:52Z","modified":"2026-03-17T18:31:28Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:06:40.510126Z"}],"nvd":[{"id":"CVE-2021-3522","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","status":"published","published":"2021-06-02T15:15:07.857Z","modified":"2026-06-17T04:05:17.4Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"ALPINE-CVE-2021-3522","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","status":"published","published":"2021-06-02T15:15:07.857Z","modified":"2026-10-23T17:17:56.196590751Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"CVE-2021-3522","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","status":"published","published":"2021-06-02T15:15:07.857Z","modified":"2026-10-24T10:30:15.465788143Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3522","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","status":"published","published":"2021-06-02T15:15:07.857Z","modified":"2026-10-23T18:03:15.292036436Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1237","title":"gstreamer-plugins-base security update","description":"GStreamer is a pipeline-based multimedia framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. The formats and processes can be changed in plugins since its plugin-based architecture. This package contains a set of well-maintained base plug-ins and wrapper scripts for the command-line tools for the base plugins.\r\n\r\nSecurity Fix(es):\r\n\r\nGStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.(CVE-2021-3522)","status":"published","published":"2021-06-26T11:04:28Z","modified":"2026-08-18T01:15:44.70673278Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2022-1601","title":"gstreamer1-plugins-base security update","description":"GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin.\r\n\r\nSecurity Fix(es):\r\n\r\nGStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.(CVE-2021-3522)","status":"published","published":"2022-03-26T11:04:52Z","modified":"2026-08-18T01:16:00.217309736Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-3522","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.","status":"published","published":"2021-04-24T00:00:00Z","modified":"2026-05-29T18:00:19.466893937Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"DLA-2641-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2021-04-27T00:00:00Z","modified":"2026-03-09T01:21:17.37302Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4903-1","title":"gst-plugins-base1.0 - security update","status":"published","published":"2021-04-24T00:00:00Z","modified":"2026-03-09T02:11:25.956519Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0334","title":"Updated gstreamer1.0-plugins packages fix security vulnerabilities","description":"GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain\nID3v2 tags (CVE-2021-3522).\n\nOverflows in AVC/HEVC NAL unit length calculations, which would lead to\nallocating infinite amounts of small memory blocks until OOM and could\npotentially also lead to memory corruptions.\n","status":"published","published":"2021-07-10T20:00:34Z","modified":"2026-04-16T04:42:26.972203933Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"SUSE-SU-2022:3907-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2021-3522: Fixed ID3v2 tag frame size check and potential invalid reads (bsc#1185448).\n","status":"published","published":"2022-11-08T11:30:57Z","modified":"2026-02-04T03:38:47.593555Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3911-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2021-3522: Fixed frame size check and potential invalid reads (bsc#1185448).\n","status":"published","published":"2022-11-08T12:15:13Z","modified":"2026-02-04T03:06:37.729729Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3916-1","title":"Security update for gstreamer-0_10-plugins-base","description":"This update for gstreamer-0_10-plugins-base fixes the following issues:\n\n- CVE-2021-3522: Fixed frame size check and potential invalid reads (bsc#1185448).\n","status":"published","published":"2022-11-08T13:53:16Z","modified":"2025-05-02T04:31:34.458685Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2023:3801-1","title":"Security update for gstreamer-plugins-base","description":"This update for gstreamer-plugins-base fixes the following issues:\n\n- CVE-2023-37327: Fixed FLAC file parsing integer overflow (bsc#1213128).\n- CVE-2023-37328: Fixed PGS file parsing heap-based buffer overflow (bsc#1213131).\n- CVE-2021-3522: Fixed frame size check and potential invalid reads (bsc#1185448).\n","status":"published","published":"2023-09-27T11:36:31Z","modified":"2026-02-04T02:50:31.76569Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-4959-1","title":"gst-plugins-base1.0 vulnerability","description":"It was discovered that GStreamer Base Plugins incorrectly handled certain inputs.\nAn attacker could possibly use this issue to expose sensitive information.\n","status":"published","published":"2021-05-18T15:22:55Z","modified":"2026-06-25T13:30:36.951939597Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}