Bug 272972 (CVE-2009-1932)

Summary:	<=media-plugins/gst-plugins-libpng-0.10.14: Multiple integer overflows (CVE-2009-1932)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	gstreamer
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=d9544bcc44adcef769cbdf7f6453e140058a3adc
Whiteboard:	B2 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	266986
Bug Blocks:

Description Alex Legler (RETIRED) archtester

2009-06-06 20:41:25 UTC

From Secunia:

A vulnerability has been discovered in GStreamer Good Plug-ins, which can be exploited by malicious people to potentially compromise an application using the library.

The vulnerability is caused due to an integer overflow error in ext/libpng/gstpngdec.c, which can be exploited to cause a heap-based buffer overflow via a specially crafted PNG file.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is confirmed in version 0.10.15. Other versions may also be affected.

Comment 1 Alex Legler (RETIRED) archtester

2009-06-06 20:42:24 UTC

======================================================
Name: CVE-2009-1932
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1932

Multiple integer overflows in the (1) user_info_callback, (2)
user_endrow_callback, and (3) gst_pngdec_task functions
(ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka
gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote
attackers to cause a denial of service and possibly execute arbitrary
code via a crafted PNG file, which triggers a buffer overflow.

Comment 2 Olivier Crete (RETIRED) gentoo-dev

2009-06-06 21:18:53 UTC

Please stabilize gst-plugins-good 0.10.14-r1 which includes the patch.

Comment 3 Samuli Suominen (RETIRED) gentoo-dev

2009-06-07 08:16:43 UTC

Sorry guys, but this isn't working like that. The patch needs to be applied in gst-plugins-libpng, thanks to our wonderful gst layout. But it's nice to recompile gst-plugins-good for just the kicks :-)

Comment 4 Christian Hoffmann (RETIRED) gentoo-dev

2009-06-07 08:36:03 UTC

Damn mid-air collisions, was just about to do mostly the same change. Adjusting summary.

Maintainers, please add the patch to gst-plugins-libpng.

Comment 5 Olivier Crete (RETIRED) gentoo-dev

2009-06-07 14:26:12 UTC

media-plugins/gst-plugins-libpng-0.10.14-r1 is now there and needs to be stabilized. Sorry for the fuck up..

Sparc will also need to do bug #266986 which I've set as a dep.

Comment 6 Tobias Klausmann (RETIRED) gentoo-dev

2009-06-07 16:25:55 UTC

Stable on alpha.

Comment 7 Christian Faulhammer (RETIRED) gentoo-dev

2009-06-08 20:19:22 UTC

x86 stable

Comment 8 Markus Meier gentoo-dev

2009-06-10 19:29:31 UTC

amd64 stable

Comment 9 Brent Baude (RETIRED) gentoo-dev

2009-06-16 19:52:12 UTC

ppc64 done

Comment 10 Brent Baude (RETIRED) gentoo-dev

2009-06-21 14:17:12 UTC

ppc done

Comment 11 Raúl Porcel (RETIRED) gentoo-dev

2009-07-01 16:54:30 UTC

sparc stable

Comment 12 Robert Buchholz (RETIRED) gentoo-dev

2009-07-12 17:48:08 UTC

GLSA 200907-11