SUSE-SU-2023:3221-1

Опубликовано: 07 авг. 2023

Источник: suse-cvrf

Описание

Security update for gstreamer-plugins-base

This update for gstreamer-plugins-base fixes the following issues:

CVE-2023-37327: Fixed GStreamer FLAC File Parsing Integer Overflow (bsc#1213128).
CVE-2023-37328: Fixed Heap-based Buffer Overflow in GStreamer PGS (bsc#1213131).

Список пакетов

SUSE Linux Enterprise Micro 5.3

gstreamer-plugins-base-1.20.1-150400.3.3.1

libgstallocators-1_0-0-1.20.1-150400.3.3.1

libgstapp-1_0-0-1.20.1-150400.3.3.1

libgstaudio-1_0-0-1.20.1-150400.3.3.1

libgstgl-1_0-0-1.20.1-150400.3.3.1

libgstpbutils-1_0-0-1.20.1-150400.3.3.1

libgstriff-1_0-0-1.20.1-150400.3.3.1

libgsttag-1_0-0-1.20.1-150400.3.3.1

libgstvideo-1_0-0-1.20.1-150400.3.3.1

SUSE Linux Enterprise Micro 5.4

gstreamer-plugins-base-1.20.1-150400.3.3.1

libgstallocators-1_0-0-1.20.1-150400.3.3.1

libgstapp-1_0-0-1.20.1-150400.3.3.1

libgstaudio-1_0-0-1.20.1-150400.3.3.1

libgstgl-1_0-0-1.20.1-150400.3.3.1

libgstpbutils-1_0-0-1.20.1-150400.3.3.1

libgstriff-1_0-0-1.20.1-150400.3.3.1

libgsttag-1_0-0-1.20.1-150400.3.3.1

libgstvideo-1_0-0-1.20.1-150400.3.3.1

SUSE Linux Enterprise Module for Basesystem 15 SP4

gstreamer-plugins-base-1.20.1-150400.3.3.1

gstreamer-plugins-base-devel-1.20.1-150400.3.3.1

gstreamer-plugins-base-lang-1.20.1-150400.3.3.1

libgstallocators-1_0-0-1.20.1-150400.3.3.1

libgstapp-1_0-0-1.20.1-150400.3.3.1

libgstaudio-1_0-0-1.20.1-150400.3.3.1

libgstfft-1_0-0-1.20.1-150400.3.3.1

libgstgl-1_0-0-1.20.1-150400.3.3.1

libgstpbutils-1_0-0-1.20.1-150400.3.3.1

libgstriff-1_0-0-1.20.1-150400.3.3.1

libgstrtp-1_0-0-1.20.1-150400.3.3.1

libgstrtsp-1_0-0-1.20.1-150400.3.3.1

libgstsdp-1_0-0-1.20.1-150400.3.3.1

libgsttag-1_0-0-1.20.1-150400.3.3.1

libgstvideo-1_0-0-1.20.1-150400.3.3.1

typelib-1_0-GstAllocators-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstApp-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstAudio-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstGL-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstGLEGL-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstGLWayland-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstGLX11-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstPbutils-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstRtp-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstRtsp-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstSdp-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstTag-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstVideo-1_0-1.20.1-150400.3.3.1

SUSE Linux Enterprise Module for Package Hub 15 SP4

libgstaudio-1_0-0-32bit-1.20.1-150400.3.3.1

libgsttag-1_0-0-32bit-1.20.1-150400.3.3.1

libgstvideo-1_0-0-32bit-1.20.1-150400.3.3.1

openSUSE Leap 15.4

gstreamer-plugins-base-1.20.1-150400.3.3.1

gstreamer-plugins-base-32bit-1.20.1-150400.3.3.1

gstreamer-plugins-base-devel-1.20.1-150400.3.3.1

gstreamer-plugins-base-devel-32bit-1.20.1-150400.3.3.1

gstreamer-plugins-base-lang-1.20.1-150400.3.3.1

libgstallocators-1_0-0-1.20.1-150400.3.3.1

libgstallocators-1_0-0-32bit-1.20.1-150400.3.3.1

libgstapp-1_0-0-1.20.1-150400.3.3.1

libgstapp-1_0-0-32bit-1.20.1-150400.3.3.1

libgstaudio-1_0-0-1.20.1-150400.3.3.1

libgstaudio-1_0-0-32bit-1.20.1-150400.3.3.1

libgstfft-1_0-0-1.20.1-150400.3.3.1

libgstfft-1_0-0-32bit-1.20.1-150400.3.3.1

libgstgl-1_0-0-1.20.1-150400.3.3.1

libgstgl-1_0-0-32bit-1.20.1-150400.3.3.1

libgstpbutils-1_0-0-1.20.1-150400.3.3.1

libgstpbutils-1_0-0-32bit-1.20.1-150400.3.3.1

libgstriff-1_0-0-1.20.1-150400.3.3.1

libgstriff-1_0-0-32bit-1.20.1-150400.3.3.1

libgstrtp-1_0-0-1.20.1-150400.3.3.1

libgstrtp-1_0-0-32bit-1.20.1-150400.3.3.1

libgstrtsp-1_0-0-1.20.1-150400.3.3.1

libgstrtsp-1_0-0-32bit-1.20.1-150400.3.3.1

libgstsdp-1_0-0-1.20.1-150400.3.3.1

libgstsdp-1_0-0-32bit-1.20.1-150400.3.3.1

libgsttag-1_0-0-1.20.1-150400.3.3.1

libgsttag-1_0-0-32bit-1.20.1-150400.3.3.1

libgstvideo-1_0-0-1.20.1-150400.3.3.1

libgstvideo-1_0-0-32bit-1.20.1-150400.3.3.1

typelib-1_0-GstAllocators-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstApp-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstAudio-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstGL-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstGLEGL-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstGLWayland-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstGLX11-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstPbutils-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstRtp-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstRtsp-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstSdp-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstTag-1_0-1.20.1-150400.3.3.1

typelib-1_0-GstVideo-1_0-1.20.1-150400.3.3.1

openSUSE Leap Micro 5.3

gstreamer-plugins-base-1.20.1-150400.3.3.1

libgstallocators-1_0-0-1.20.1-150400.3.3.1

libgstapp-1_0-0-1.20.1-150400.3.3.1

libgstaudio-1_0-0-1.20.1-150400.3.3.1

libgstgl-1_0-0-1.20.1-150400.3.3.1

libgstpbutils-1_0-0-1.20.1-150400.3.3.1

libgstriff-1_0-0-1.20.1-150400.3.3.1

libgsttag-1_0-0-1.20.1-150400.3.3.1

libgstvideo-1_0-0-1.20.1-150400.3.3.1

openSUSE Leap Micro 5.4

gstreamer-plugins-base-1.20.1-150400.3.3.1

libgstallocators-1_0-0-1.20.1-150400.3.3.1

libgstapp-1_0-0-1.20.1-150400.3.3.1

libgstaudio-1_0-0-1.20.1-150400.3.3.1

libgstgl-1_0-0-1.20.1-150400.3.3.1

libgstpbutils-1_0-0-1.20.1-150400.3.3.1

libgstriff-1_0-0-1.20.1-150400.3.3.1

libgsttag-1_0-0-1.20.1-150400.3.3.1

libgstvideo-1_0-0-1.20.1-150400.3.3.1

Ссылки

https://www.suse.com/support/update/announcement/2023/suse-su-20233221-1/
Link for SUSE-SU-2023:3221-1
https://lists.suse.com/pipermail/sle-updates/2023-August/030825.html
E-Mail link for SUSE-SU-2023:3221-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1213128
SUSE Bug 1213128
https://bugzilla.suse.com/1213131
SUSE Bug 1213131
https://www.suse.com/security/cve/CVE-2023-37327/
SUSE CVE CVE-2023-37327 page
https://www.suse.com/security/cve/CVE-2023-37328/
SUSE CVE CVE-2023-37328 page

Описание

GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of FLAC audio files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20775.

Затронутые продукты

SUSE Linux Enterprise Micro 5.3:gstreamer-plugins-base-1.20.1-150400.3.3.1

SUSE Linux Enterprise Micro 5.3:libgstallocators-1_0-0-1.20.1-150400.3.3.1

SUSE Linux Enterprise Micro 5.3:libgstapp-1_0-0-1.20.1-150400.3.3.1

SUSE Linux Enterprise Micro 5.3:libgstaudio-1_0-0-1.20.1-150400.3.3.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-37327.html
CVE-2023-37327
https://bugzilla.suse.com/1213128
SUSE Bug 1213128

Описание

GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-20994.

Затронутые продукты

SUSE Linux Enterprise Micro 5.3:gstreamer-plugins-base-1.20.1-150400.3.3.1

SUSE Linux Enterprise Micro 5.3:libgstallocators-1_0-0-1.20.1-150400.3.3.1

SUSE Linux Enterprise Micro 5.3:libgstapp-1_0-0-1.20.1-150400.3.3.1

SUSE Linux Enterprise Micro 5.3:libgstaudio-1_0-0-1.20.1-150400.3.3.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-37328.html
CVE-2023-37328
https://bugzilla.suse.com/1213131
SUSE Bug 1213131

SUSE-SU-2023:3221-1

Описание

Список пакетов

SUSE Linux Enterprise Micro 5.3

SUSE Linux Enterprise Micro 5.4

SUSE Linux Enterprise Module for Basesystem 15 SP4

SUSE Linux Enterprise Module for Package Hub 15 SP4

openSUSE Leap 15.4

openSUSE Leap Micro 5.3

openSUSE Leap Micro 5.4

Ссылки

Уязвимость: CVE-2023-37327

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2023-37328

Описание

Затронутые продукты

Ссылки