GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.

The remote host is affected by the vulnerability described in GLSA-202208-31 (GStreamer, GStreamer Plugins: Multiple Vulnerabilities)

  - A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a     h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code     execution. (CVE-2021-3185)

  - GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain     malformed Matroska files. (CVE-2021-3497)

  - GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
    (CVE-2021-3498)

  - GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
    (CVE-2021-3522)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1230-1 advisory.

  - GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain     malformed Matroska files. (CVE-2021-3497)

  - GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
    (CVE-2021-3498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2915-1 advisory.

  - GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain     malformed Matroska files. (CVE-2021-3497)

  - GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
    (CVE-2021-3498)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2915-1 advisory.

  - GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain     malformed Matroska files. (CVE-2021-3497)

  - GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
    (CVE-2021-3498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4928-1 advisory.

  - GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain     malformed Matroska files. (CVE-2021-3497)

  - GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
    (CVE-2021-3498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in plugins for the GStreamer media framework, which may result in denial of service or potentially the execution of arbitrary code if a malformed media file is opened.

ID	Name	Product	Family	Severity
164117	GLSA-202208-31 : GStreamer, GStreamer Plugins: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
153025	openSUSE 15 Security Update : gstreamer-plugins-good (openSUSE-SU-2021:1230-1)	Nessus	SuSE Local Security Checks	high
153015	SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-good (SUSE-SU-2021:2915-1)	Nessus	SuSE Local Security Checks	high
153008	openSUSE 15 Security Update : gstreamer-plugins-good (openSUSE-SU-2021:2915-1)	Nessus	SuSE Local Security Checks	high
149055	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : GStreamer Good Plugins vulnerabilities (USN-4928-1)	Nessus	Ubuntu Local Security Checks	high
149011	Debian DSA-4900-1 : gst-plugins-good1.0 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-3498

high

Tenable Plugins

critical

high

high

high

high

high