Upstream information
Description
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having critical severity.
| CVSS detail | National Vulnerability Database |
|---|---|
| Base Score | 9.3 |
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | Complete |
| Integrity Impact | Complete |
| Availability Impact | Complete |
SUSE Security Advisories:
- SUSE-SR:2009:005, published Mon, 02 Mar 2009 13:00:00 +0000
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Linux Enterprise Server 11 SP1 |
| Patchnames: SUSE Linux Enterprise Server 11 SP1 GA gstreamer-0_10-plugins-good-0.10.17-1.1.126 |
| SUSE Linux Enterprise Server 11 SP2 |
| Patchnames: SUSE Linux Enterprise Server 11 SP2 GA gstreamer-0_10-plugins-good-0.10.30-5.8.11 |
| SUSE Linux Enterprise Server 11 SP3 |
| Patchnames: SUSE Linux Enterprise Server 11 SP3 GA gstreamer-0_10-plugins-good-0.10.30-5.8.11 |
| SUSE Linux Enterprise Server 11 SP4 |
| Patchnames: SUSE Linux Enterprise Server 11 SP4 GA gstreamer-0_10-plugins-good-0.10.30-5.12.15 |
SUSE Timeline for this CVE
CVE page created: Fri Jun 28 03:23:37 2013CVE page last modified: Mon Oct 6 18:15:37 2025