CVE-2021-3497
gstreamer-plugins-good: Use-after-free in matroska demuxing
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
GStreamer versiones anteriores a 1.18.4, podría acceder a la memoria ya liberada en rutas de código de error al demultiplexar determinados archivos Matroska malformados
It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to cause access sensitive information or cause a crash. It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-04-13 CVE Reserved
- 2021-04-19 CVE Published
- 2024-08-03 CVE Updated
- 2025-04-01 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2021/04/msg00027.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1945339 | 2022-09-28 |
| URL | Date | SRC |
|---|---|---|
| https://gstreamer.freedesktop.org/security/sa-2021-0002.html | 2022-09-28 | |
| https://security.gentoo.org/glsa/202208-31 | 2022-09-28 | |
| https://www.debian.org/security/2021/dsa-4900 | 2022-09-28 | |
| https://access.redhat.com/security/cve/CVE-2021-3497 | 2022-11-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gstreamer Project Search vendor "Gstreamer Project" | Gstreamer Search vendor "Gstreamer Project" for product "Gstreamer" | >= 0.10.0 < 1.18.4 Search vendor "Gstreamer Project" for product "Gstreamer" and version " >= 0.10.0 < 1.18.4" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | - |
Affected
| ||||||