{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-37328", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2023-06-30T17:27:13.599Z", "datePublished": "2024-05-03T01:58:20.745Z", "dateUpdated": "2024-09-18T18:29:30.133Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-09-18T18:29:30.133Z"}, "title": "GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-20994."}], "affected": [{"vendor": "GStreamer", "product": "GStreamer", "versions": [{"version": "1.22 and latest commit 6dff93acf69c40271a769aa2fa35efbcc2aeb9b4", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-901/", "name": "ZDI-23-901", "tags": ["x_research-advisory"]}, {"url": "https://gstreamer.freedesktop.org/security/sa-2023-0003.html", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2023-06-30T12:37:25.329-05:00", "datePublic": "2023-07-06T16:48:24.761-05:00", "source": {"lang": "en", "value": "MICHAEL RANDRIANANTENAINA [https://elkamika.blogspot.com/]"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-37328", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-06T18:26:04.497010Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*"], "vendor": "gstreamer", "product": "gstreamer", "versions": [{"status": "affected", "version": "1.x", "lessThan": "1.22.4", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*"], "vendor": "gstreamer", "product": "gstreamer", "versions": [{"status": "affected", "version": "1.x", "lessThan": "1.20.7", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*"], "vendor": "gstreamer", "product": "gstreamer", "versions": [{"status": "affected", "version": "0.10.x"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:24:31.282Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:09:34.233Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-901/", "name": "ZDI-23-901", "tags": ["x_research-advisory", "x_transferred"]}, {"url": "https://gstreamer.freedesktop.org/security/sa-2023-0003.html", "name": "vendor-provided URL", "tags": ["vendor-advisory", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-901/", "name": "ZDI-23-901", "tags": ["x_research-advisory", "x_transferred"]}, {"url": "https://gstreamer.freedesktop.org/security/sa-2023-0003.html", "name": "vendor-provided URL", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:09:34.233Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-37328", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-06T18:26:04.497010Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*"], "vendor": "gstreamer", "product": "gstreamer", "versions": [{"status": "affected", "version": "1.x", "lessThan": "1.22.4", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*"], "vendor": "gstreamer", "product": "gstreamer", "versions": [{"status": "affected", "version": "1.x", "lessThan": "1.20.7", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*"], "vendor": "gstreamer", "product": "gstreamer", "versions": [{"status": "affected", "version": "0.10.x"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-06T18:25:57.500Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "MICHAEL RANDRIANANTENAINA [https://elkamika.blogspot.com/]"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "GStreamer", "product": "GStreamer", "versions": [{"status": "affected", "version": "R.47.0.0 AutoCAD 2021 & R.47.0.0 AutoCAD LT 2021"}], "defaultStatus": "unknown"}], "datePublic": "2023-07-06T16:48:24.761-05:00", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-901/", "name": "ZDI-23-901", "tags": ["x_research-advisory"]}, {"url": "https://gstreamer.freedesktop.org/security/sa-2023-0003.html", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2023-06-30T12:37:25.329-05:00", "descriptions": [{"lang": "en", "value": "GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20994."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-05-03T01:58:20.745Z"}}}, "cveMetadata": {"cveId": "CVE-2023-37328", "state": "PUBLISHED", "dateUpdated": "2024-08-02T17:09:34.233Z", "dateReserved": "2023-06-30T17:27:13.599Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2024-05-03T01:58:20.745Z", "assignerShortName": "zdi"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-20994."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de desbordamiento de b\u00fafer de almacenamiento din\u00e1mico en el an\u00e1lisis de archivos PGS de GStreamer. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de GStreamer. Se requiere la interacci\u00f3n con esta librer\u00eda para aprovechar esta vulnerabilidad, pero los vectores de ataque pueden variar seg\u00fan la implementaci\u00f3n. La falla espec\u00edfica existe en el an\u00e1lisis de archivos de subt\u00edtulos PGS. El problema se debe a la falta de una validaci\u00f3n adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos en un b\u00fafer basado en mont\u00f3n. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual. Era ZDI-CAN-20994."}], "id": "CVE-2023-37328", "lastModified": "2024-09-18T19:15:30.930", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}, "published": "2024-05-03T02:15:43.450", "references": [{"source": "zdi-disclosures@trendmicro.com", "url": "https://gstreamer.freedesktop.org/security/sa-2023-0003.html"}, {"source": "zdi-disclosures@trendmicro.com", "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-901/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:3088", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "gstreamer1-plugins-base-0:1.16.1-3.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-22T00:00:00Z"}, {"advisory": "RHSA-2024:2302", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "gstreamer1-plugins-base-0:1.22.1-2.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}], "bugzilla": {"description": "gstreamer-plugins-base: heap overwrite in subtitle parsing", "id": "2254540", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254540"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-122->CWE-787", "details": ["GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\nThe specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n. Was ZDI-CAN-20994.", "A heap-based buffer overflow was found in the subparse subtitle parser of GStreamer when processing specific SRT subtitle files. This issue could allow a malicious third party to crash the application and execute code through manipulation of the heap."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2023-37328", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "gstreamer-plugins-base", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "gstreamer1-plugins-base", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "gstreamer-plugins-base", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "libreoffice:flatpak/gstreamer1-plugins-base", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2023-07-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-37328\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-37328\nhttps://gstreamer.freedesktop.org/security/sa-2023-0002.html"], "threat_severity": "Moderate", "upstream_fix": "gst-plugins-base 1.22.4, gst-plugins-base 1.20.7"}