Bugzilla Bug 256096

Jan Lieskovsky wrote:
Multiple heap-based buffer overflow vulnerabilities and one an array index
out of bounds vulnerability has been reported by Tobias Klein to 
be present in the GStreamer demuxer responsible for demuxing QuickTime
media *.mov files into raw or compressed audio and/or video streams. A remote
attacker could use this flaws to execute arbitrary code in the context of an
application using the GStreamer multimedia framework.

gstreamer herd: please bump or apply patch:
http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53
Also, could you please clarify which ebuilds ship and build the file qtdemux.c
?

(In reply to comment #0)
> Also, could you please clarify which ebuilds ship and build the file qtdemux.c

media-libs/gst-plugins-good - that is, it's not introducing extra deps and
therefore not split to a separate package.

0.10.13 with only this fix has been released upstream

CVE-2009-0386 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0386):
  Heap-based buffer overflow in the qtdemux_parse_samples function in
  gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka
  gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers
  to execute arbitrary code via crafted Composition Time To Sample
  (ctts) atom data in a malformed QuickTime media .mov file.

CVE-2009-0387 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0387):
  Array index error in the qtdemux_parse_samples function in
  gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka
  gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to
  cause a denial of service (application crash) and possibly execute
  arbitrary code via crafted Sync Sample (aka stss) atom data in a
  malformed QuickTime media .mov file, related to "mark keyframes."

CVE-2009-0397 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0397):
  Heap-based buffer overflow in the qtdemux_parse_samples function in
  gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka
  gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka
  gstreamer-plugins) 0.8.5, might allow remote attackers to execute
  arbitrary code via crafted Time-to-sample (aka stts) atom data in a
  malformed QuickTime media .mov file.

CVE-2009-0398 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0398):
  Array index error in the gst_qtp_trak_handler function in
  gst/qtdemux/qtdemux.c in GStreamer Plug-ins (aka gstreamer-plugins)
  0.6.0 allows remote attackers to have an unknown impact via a crafted
  QuickTime media file.

Adding the stabilization bug as a dep

GLSA 200907-11