CVE-2009-0586

NameCVE-2009-0586
DescriptionInteger overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gst-plugins-base0.10sourceetch(not affected)
gst-plugins-base0.10sourcelenny(not affected)
gst-plugins-base0.10source(unstable)0.10.22-4

Notes

[lenny] - gst-plugins-base0.10 <not-affected> (Vulnerable lib calls not present)
[etch] - gst-plugins-base0.10 <not-affected> (Vulnerable lib calls not present)
Search for package or bug name: Reporting problems