From owner-freebsd-multimedia@FreeBSD.ORG Sun Mar 8 19:40:03 2009 Return-Path: Delivered-To: multimedia@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 279481065748; Sun, 8 Mar 2009 19:40:03 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 0278A8FC1D; Sun, 8 Mar 2009 19:40:03 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n28Je2Od018086; Sun, 8 Mar 2009 19:40:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n28Je28Z018085; Sun, 8 Mar 2009 19:40:02 GMT (envelope-from gnats) Resent-Date: Sun, 8 Mar 2009 19:40:02 GMT Resent-Message-Id: <200903081940.n28Je28Z018085@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@freebsd.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Cc: multimedia@freebsd.org, kwm@freebsd.org, ahze@freebsd.org Resent-Reply-To: FreeBSD-gnats-submit@freebsd.org, Eygene Ryabinkin Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9EB55106566C for ; Sun, 8 Mar 2009 19:39:43 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id 50BCE8FC0A for ; Sun, 8 Mar 2009 19:39:43 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from phoenix.codelabs.ru (ppp85-141-67-181.pppoe.mtu-net.ru [85.141.67.181]) by 0.mx.codelabs.ru with esmtps (TLSv1:CAMELLIA256-SHA:256) id 1LgOqc-000OVy-F5 for FreeBSD-gnats-submit@freebsd.org; Sun, 08 Mar 2009 22:39:42 +0300 Message-Id: <20090308193942.381EFB806B@phoenix.codelabs.ru> Date: Sun, 8 Mar 2009 22:39:42 +0300 (MSK) From: Eygene Ryabinkin To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.113 X-GNATS-Notify: multimedia@freebsd.org, kwm@freebsd.org, ahze@freebsd.org Cc: Subject: ports/132428: [vuxml] multimedia/gstreamer-plugins-good: document TKADV2009-003 X-BeenThere: freebsd-multimedia@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Eygene Ryabinkin List-Id: Multimedia discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Mar 2009 19:40:03 -0000 >Number: 132428 >Category: ports >Synopsis: [vuxml] multimedia/gstreamer-plugins-good: document TKADV2009-003 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Mar 08 19:40:02 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Eygene Ryabinkin >Release: FreeBSD 7.1-STABLE amd64 >Organization: Code Labs >Environment: System: FreeBSD 7.1-STABLE amd64 >Description: Multiple buffer and heap overflows were found in gstreamer 'good' plugins by Tobias Klein from TrapKit. >How-To-Repeat: http://trapkit.de/advisories/TKADV2009-003.txt >Fix: The following VuXML entry should be evaluated and added: --- vuln.xml begins here --- gstreamer-plugins-good -- multiple memory overflows gstreamer-plugins-good 0.10.9,30.10.12,3

Tobias Klein reports:

GStreamer contains several heap buffer overflows and an array index out of bounds vulnerability while parsing malformed QuickTime media files. The vulnerabilities may be exploited by a (remote) attacker to execute arbitrary code in the context of an application using the GStreamer multimedia framework.

 CVE-2009-0386 CVE-2009-0387 CVE-2009-0397 http://www.trapkit.de/advisories/TKADV2009-003.txt http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html 2009-01-22 TODAY --- vuln.xml ends here --- >Release-Note: >Audit-Trail: >Unformatted: