DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gstreamer-plugins-good: Heap corruption in matroska demuxing (CVE-2021-3498)

  - gstreamer-plugins-good: Potential heap overwrite in mp4 demuxing using zlib decompression (CVE-2022-2122)

  - The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before     1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted     tag value. (CVE-2016-10199)

  - The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3     allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the     current stts index. (CVE-2017-5840)

  - GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain     malformed Matroska files. (CVE-2021-3497)

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of FLAC audio files. The issue results from     the lack of proper validation of user-supplied data, which can result in an integer overflow before     allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-20775. (CVE-2023-37327)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gstreamer-plugins-good: Heap buffer overflow in FLIC decoder (CVE-2016-9636)

  - The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer     before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a     crafted audio file. (CVE-2016-10198)

  - The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before     1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted     tag value. (CVE-2016-10199)

  - Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder     in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service     (application crash) via the start_line parameter. (CVE-2016-9634)

  - Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder     in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service     (application crash) by providing a 'skip count' that goes beyond initialized buffer. (CVE-2016-9635)

  - The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers     to cause a denial of service (invalid memory read and crash) via a crafted FLIC file. (CVE-2016-9807)

  - The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-     bounds write and crash) via a crafted series of skip and count pairs. (CVE-2016-9808)

  - The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3     allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the     current stts index. (CVE-2017-5840)

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

  - GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of FLAC audio files. The issue results from     the lack of proper validation of user-supplied data, which can result in an integer overflow before     allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-20775. (CVE-2023-37327)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the gstreamer1-plugins-good-1.18.4-6.el9 build changelog.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3688-1 advisory.

  - GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain     malformed Matroska files. (CVE-2021-3497)

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

  - Integer overflow leading to heap overwrite in FLAC image tag handling (CVE-2023-37327) (CVE-2023-37327)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2260 advisory.

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2260 advisory.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2260 advisory.

  - gstreamer-plugins-good: Potential heap overwrite in gst_matroska_demux_add_wvpk_header() (CVE-2022-1920)

  - gstreamer-plugins-good: Heap-based buffer overflow in the avi demuxer when handling certain AVI files     (CVE-2022-1921)

  - gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using zlib decompression (CVE-2022-1922)

  - gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using bz2 decompression (CVE-2022-1923)

  - gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using lzo decompression (CVE-2022-1924)

  - gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using HEADERSTRIP decompression     (CVE-2022-1925)

  - gstreamer-plugins-good: Potential heap overwrite in mp4 demuxing using zlib decompression (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3906-1 advisory.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3908-1 advisory.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the gstreamer1-plugins-good package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gstreamer1-plugins-good packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2957-1 advisory.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2911-1 advisory.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the gstreamer1-plugins-good package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5204 advisory.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3069 advisory.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5555-1 advisory.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196501	RHEL 6 : gstreamer-plugins-good (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196448	RHEL 7 : gstreamer-plugins-good (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
191399	CentOS 9 : gstreamer1-plugins-good-1.18.4-6.el9	Nessus	CentOS Local Security Checks	high
181661	SUSE SLES15 Security Update : gstreamer-plugins-good (SUSE-SU-2023:3688-1)	Nessus	SuSE Local Security Checks	high
175704	Oracle Linux 9 : gstreamer1-plugins-good (ELSA-2023-2260)	Nessus	Oracle Linux Local Security Checks	high
175608	AlmaLinux 9 : gstreamer1-plugins-good (ALSA-2023:2260)	Nessus	Alma Linux Local Security Checks	high
175482	RHEL 9 : gstreamer1-plugins-good (RHSA-2023:2260)	Nessus	Red Hat Local Security Checks	high
167209	SUSE SLED12 / SLES12 Security Update : gstreamer-0_10-plugins-good (SUSE-SU-2022:3906-1)	Nessus	SuSE Local Security Checks	high
167208	SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-good (SUSE-SU-2022:3908-1)	Nessus	SuSE Local Security Checks	high
166647	EulerOS 2.0 SP3 : gstreamer1-plugins-good (EulerOS-SA-2022-2612)	Nessus	Huawei Local Security Checks	high
165840	EulerOS 2.0 SP8 : gstreamer1-plugins-good (EulerOS-SA-2022-2463)	Nessus	Huawei Local Security Checks	high
164547	SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-good (SUSE-SU-2022:2957-1)	Nessus	SuSE Local Security Checks	high
164462	SUSE SLES12 Security Update : gstreamer-plugins-good (SUSE-SU-2022:2911-1)	Nessus	SuSE Local Security Checks	high
164197	EulerOS 2.0 SP5 : gstreamer1-plugins-good (EulerOS-SA-2022-2269)	Nessus	Huawei Local Security Checks	high
163980	Debian DSA-5204-1 : gst-plugins-good1.0 - security update	Nessus	Debian Local Security Checks	high
163959	Debian DLA-3069-1 : gst-plugins-good1.0 - LTS security update	Nessus	Debian Local Security Checks	high
163923	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : GStreamer Good Plugins vulnerabilities (USN-5555-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2022-1925

high

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high