CVE-2009-0586

Publication date 14 March 2009

Last updated 24 July 2024

Ubuntu priority

Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gst-plugins-base0.10	8.10 intrepid	Fixed 0.10.21-3ubuntu0.1
	8.04 LTS hardy	Not affected
	7.10 gutsy	Not affected
	6.06 LTS dapper	Not affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
gst-plugins-base0.10	Other: http://ocert.org/patches/2008-015/gst-plugins-base-CVE-2009-0586.diff

References

Related Ubuntu Security Notices (USN)

USN-735-1
GStreamer Base Plugins vulnerability
16 March 2009

Other references

https://www.cve.org/CVERecord?id=CVE-2009-0586