USN-8896-1: GStreamer Ugly Plugins vulnerabilities
Ubuntu patches GStreamer Ugly Plugins flaws that could run code from crafted RealMedia or ASF files.
Ubuntu published USN-8896-1 for GStreamer Ugly Plugins flaws in parsing malformed media. Michael Randrianantenaina found that crafted RealMedia files could let an attacker execute arbitrary code if a user opens them; CVE-2023-38103 and CVE-2023-38104 affect Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, and 22.04 LTS. A separate issue in handling malformed ASF and RealMedia files could also lead to code execution on those releases. The notice does not report exploitation in the wild.
- Crafted RealMedia files could allow arbitrary code execution in GStreamer Ugly Plugins.
- CVE-2023-38103 and CVE-2023-38104 affect Ubuntu 16.04 through 22.04 LTS.
- Separate malformed ASF and RealMedia handling flaws can also lead to code execution.
- Exploitation requires a user to open a crafted media file.
- Products
- GStreamer Ugly PluginsUbuntu
- Organizations
- Canonical
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2023-38103+1 related CVE | GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability | 8.8 | 2% |
From the original article
Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.