CVE-2022-2122

DOS / potencial escritura excesiva de la pila en qtdemux usando descompresión zlib. Desbordamiento de enteros en un elemento de qtdemux en la función qtdemux_inflate que causa un segfault, o podría causar una escritura excesiva de la pila, dependiendo de la libc y el SO. Dependiendo de la libc usada, y de las capacidades del SO subyacente, podría ser sólo un segfault o una escritura excesiva de la pila.

A flaw was found in GStreamer. An integer overflow can lead to a heap-based buffer overflow in the qt demuxer when processing a specially crafted QuickTime/MP4 file using zlib decompression. This vulnerability can result in application crash, memory corruption, and code execution.

An update that fixes 7 vulnerabilities is now available. This update for gstreamer-plugins-good fixes the following issues. Fixed integer overflow in WavPack header handling code. Fixed integer overflow resulting in heap corruption in avidemux element. Fixed integer overflows in mkv demuxing. Fixed integer overflows in mkv demuxing using bzip. Fixed integer overflows in mkv demuxing using lzo. Fixed integer overflows in mkv demuxing using HEADERSTRIP. Fixed integer overflows in qtdemux using zlib.